Spyware / Malware / Virus Removal

Google Redirect

17 min read

Looking for the outcome? Ask AI

Timo529 Topic Starter

Post #1January 8, 2011, 3:46 AM UTC

Hi I am having some issues with being redirected every time i search for something on google.
I attempted to run the OTL tool but whenever i clicked run scan it just sat there i left it alone for an hour and nothing ever came up. I was however able to run the hijackthis and also the D.D.S. The contents of the hijackthis.log are below:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:36:43 PM, on 1/7/2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\runservice.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\TuneUpDefragService.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner\Desktop\OTL.exe
C:\zMUD\Zmud.exe
C:\zMUD\Zmud.exe
C:\Program Files\Starcraft\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50091
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Player\rpbrowserrecordplugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\BitComet\tools\BitCometBHO_1.4.11.9.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [Winsock2 driver] SYSENGR.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [Winsock2 driver] SYSENGR.EXE (User 'Default user')
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &D&ownload &with BitComet - res://G:\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://G:\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://G:\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\BitComet\tools\BitCometBHO_1.4.11.9.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Broken Internet access because of LSP provider 'c:\program files\newdotnet\newdotnet6_38.dll' missing
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted IP range: http://192.168.1.254
O15 - ESC Trusted IP range: http://192.168.1.254
O16 - DPF: JT's Blocks - http://download.games.yahoo.com/games/clients/y/blt1_x.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt0_x.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.srtest.com/sysreqlab.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://l.yimg.com/jh/games/web_games/popca…aploader_v6.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{39F367EC-7002-4DEA-B1F7-7CBDAE6990D6}: NameServer = 208.67.222.222,208.67.220.220
O17 - HKLM\System\CCS\Services\Tcpip\..\{40033D2F-928D-43B4-AF7D-B35FE15E0DC4}: NameServer = 208.67.222.222,208.67.220.220
O17 - HKLM\System\CCS\Services\Tcpip\..\{BE030BCA-61E8-434C-BC00-A1B9994009E9}: NameServer = 208.67.222.222,208.67.220.220
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: khfffdb - khfffdb.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Unknown owner - F:\isoburener\ImapiHelper.exe (file missing)
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

–
End of file - 8858 bytes

mowman

Post #2January 8, 2011, 10:56 AM UTC

Hello,
Welcome to WhatTheTech. My name is mowman, and I will be helping you fix your problems.

If you do not make a reply in 3 days, we will have to close your topic.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the Options button at the top bar of this topic and Track this topic. The topics you are tracking can be found by clicking on My Topics at the top of any page.

Please take note of some guidelines for this fix:

•Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
•If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
•Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
•Please reply using the button in the lower right hand corner of your screen. Do not start a new topic. The logs that you post should be pasted directly into the reply.
Only attach them if requested or if they do not fit into the post

Please download TDSSKiller.zip

Extract it to your desktop
Double click TDSSKiller.exe
Press Start Scan
- Only if Malicious objects are found then ensure Cure is selected
  If suspicious objects are found select skip
- Then click Continue > Reboot now
Copy and paste the log in your next reply
- A copy of the log will be saved automatically to the root of the drive (typically C:\)

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

In your next reply please post the following.

Both OTL logs
TDSSKiller log

Timo529

Post #3January 8, 2011, 6:26 PM UTC

TDSSKiller Log:
2011/01/08 09:28:58.0453 TDSS rootkit removing tool 2.4.12.0 Dec 16 2010 09:46:46
2011/01/08 09:28:58.0453 ================================================================================
2011/01/08 09:28:58.0453 SystemInfo:
2011/01/08 09:28:58.0453
2011/01/08 09:28:58.0453 OS Version: 5.1.2600 ServicePack: 2.0
2011/01/08 09:28:58.0453 Product type: Workstation
2011/01/08 09:28:58.0453 ComputerName: YOUR-B79WZ4ROSE
2011/01/08 09:28:58.0453 UserName: Owner
2011/01/08 09:28:58.0453 Windows directory: C:\WINDOWS
2011/01/08 09:28:58.0453 System windows directory: C:\WINDOWS
2011/01/08 09:28:58.0453 Processor architecture: Intel x86
2011/01/08 09:28:58.0453 Number of processors: 1
2011/01/08 09:28:58.0453 Page size: 0x1000
2011/01/08 09:28:58.0453 Boot type: Normal boot
2011/01/08 09:28:58.0453 ================================================================================
2011/01/08 09:29:08.0515 Initialize success
2011/01/08 09:29:31.0234 ================================================================================
2011/01/08 09:29:31.0234 Scan started
2011/01/08 09:29:31.0234 Mode: Manual;
2011/01/08 09:29:31.0234 ================================================================================
2011/01/08 09:29:32.0984 ACPI (a10c7534f7223f4a73a948967d00e69b) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/01/08 09:29:33.0265 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/01/08 09:29:33.0906 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys
2011/01/08 09:29:34.0453 AegisP (30bb1bde595ca65fd5549462080d94e5) C:\WINDOWS\system32\DRIVERS\AegisP.sys
2011/01/08 09:29:34.0968 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys
2011/01/08 09:29:36.0015 ALCXSENS (fbbcb95f677cbaa924140b6ea2d9a97b) C:\WINDOWS\system32\drivers\ALCXSENS.SYS
2011/01/08 09:29:36.0484 ALCXWDM (8d6c30e515717248e0e52b85fd7ac466) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
2011/01/08 09:29:37.0250 AmdK7 (680ad1c1bb16239e28d8f33a54a7a3c7) C:\WINDOWS\system32\DRIVERS\amdk7.sys
2011/01/08 09:29:37.0531 Amsdumrsucsu (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\System32\drivers\modem.sys
2011/01/08 09:29:39.0234 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/01/08 09:29:39.0625 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/01/08 09:29:40.0562 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/01/08 09:29:41.0109 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/01/08 09:29:41.0468 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/01/08 09:29:41.0781 Bridge (e4e6a0922e3d983728c9ad4e8d466954) C:\WINDOWS\system32\DRIVERS\bridge.sys
2011/01/08 09:29:41.0843 BridgeMP (e4e6a0922e3d983728c9ad4e8d466954) C:\WINDOWS\system32\DRIVERS\bridge.sys
2011/01/08 09:29:42.0125 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/01/08 09:29:42.0343 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/01/08 09:29:42.0781 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/01/08 09:29:43.0062 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/01/08 09:29:43.0328 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/01/08 09:29:43.0953 cmdGuard (d0280a0bde135119079e8aec7ce9b8e7) C:\WINDOWS\system32\DRIVERS\cmdguard.sys
2011/01/08 09:29:44.0234 cmdHlp (e5cca9f01e1b4aba0ad973538c054fac) C:\WINDOWS\system32\DRIVERS\cmdhlp.sys
2011/01/08 09:29:45.0468 DCamUSBVeo532 (e3834cdc0ea44bdda7c54861a4c92d32) C:\WINDOWS\system32\Drivers\ubVeo532.sys
2011/01/08 09:29:45.0781 Disk (edc0b2042697da1212782d4260c3ac9b) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/01/08 09:29:45.0781 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\disk.sys. Real md5: edc0b2042697da1212782d4260c3ac9b, Fake md5: 00ca44e4534865f8a3b64f7c0984bff0
2011/01/08 09:29:45.0812 Disk - detected Rootkit.Win32.TDSS.tdl3 (0)
2011/01/08 09:29:46.0109 dmboot (c0fbb516e06e243f0cf31f597e7ebf7d) C:\WINDOWS\system32\drivers\dmboot.sys
2011/01/08 09:29:46.0421 dmio (f5e7b358a732d09f4bcf2824b88b9e28) C:\WINDOWS\system32\drivers\dmio.sys
2011/01/08 09:29:46.0687 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/01/08 09:29:46.0937 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys
2011/01/08 09:29:47.0437 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/01/08 09:29:47.0718 DTC328X (30ee5d3765328277dd14fba511b935f6) C:\WINDOWS\System32\drivers\DTC328X.SYS
2011/01/08 09:29:48.0250 epmntdrv (f07ba56b0235f15eff8f10dc6389c42e) C:\WINDOWS\system32\epmntdrv.sys
2011/01/08 09:29:48.0531 EuGdiDrv (1f2f4ab15ce03ecc257feb2f6dc5a013) C:\WINDOWS\system32\EuGdiDrv.sys
2011/01/08 09:29:48.0828 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/01/08 09:29:49.0140 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys
2011/01/08 09:29:49.0390 Fips (e153ab8a11de5452bcf5ac7652dbf3ed) C:\WINDOWS\system32\drivers\Fips.sys
2011/01/08 09:29:49.0640 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
2011/01/08 09:29:49.0937 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\drivers\fltmgr.sys
2011/01/08 09:29:50.0234 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/01/08 09:29:50.0500 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/01/08 09:29:50.0796 GEARAspiWDM (f2f431d1573ee632975c524418655b84) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
2011/01/08 09:29:51.0109 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/01/08 09:29:51.0437 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/01/08 09:29:51.0906 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/01/08 09:29:52.0687 i8042prt (5502b58eef7486ee6f93f3f164dcb808) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/01/08 09:29:53.0000 ialm (44b7d5a4f2bd9fe21aea0bb0bace38c4) C:\WINDOWS\system32\DRIVERS\ialmnt5.sys
2011/01/08 09:29:53.0343 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/01/08 09:29:53.0937 Inspect (55b072558a8523084a2eb0f1980a27ec) C:\WINDOWS\system32\DRIVERS\inspect.sys
2011/01/08 09:29:54.0203 IntelIde (2d722b2b54ab55b2fa475eb58d7b2aad) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/01/08 09:29:54.0468 intelppm (279fb78702454dff2bb445f238c048d2) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/01/08 09:29:54.0765 ip6fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\drivers\ip6fw.sys
2011/01/08 09:29:55.0031 IPFilter (9ea02e03ed52d25551a6e46cf3b94b01) C:\WINDOWS\system32\DRIVERS\IPFilter.sys
2011/01/08 09:29:55.0312 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/01/08 09:29:55.0593 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/01/08 09:29:55.0859 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/01/08 09:29:56.0171 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/01/08 09:29:56.0468 irda (86c204836feec22510d434982d4221b8) C:\WINDOWS\system32\DRIVERS\irda.sys
2011/01/08 09:29:56.0750 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/01/08 09:29:57.0015 irsir (0501f0b9ab08425f8c0eacbdcc04aa32) C:\WINDOWS\system32\DRIVERS\irsir.sys
2011/01/08 09:29:57.0296 isapnp (e504f706ccb699c2596e9a3da1596e87) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/01/08 09:29:57.0890 Kbdclass (ebdee8a2ee5393890a1acee971c4c246) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/01/08 09:29:58.0328 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys
2011/01/08 09:29:58.0609 KSecDD (674d3e5a593475915dc6643317192403) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/01/08 09:29:59.0312 ltmodem5 (897d2fa0102c0cd5255f6fe94bbfa7b3) C:\WINDOWS\system32\DRIVERS\ltmdmnt.sys
2011/01/08 09:29:59.0625 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/01/08 09:29:59.0921 Modem (6fc6f9d7acc36dca9b914565a3aeda05) C:\WINDOWS\system32\drivers\Modem.sys
2011/01/08 09:30:00.0203 Mouclass (34e1f0031153e491910e12551400192c) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/01/08 09:30:00.0484 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/01/08 09:30:00.0750 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/01/08 09:30:01.0468 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/01/08 09:30:01.0812 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/01/08 09:30:02.0140 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys
2011/01/08 09:30:02.0437 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/01/08 09:30:02.0718 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/01/08 09:30:03.0000 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/01/08 09:30:03.0281 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/01/08 09:30:03.0562 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/01/08 09:30:03.0828 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys
2011/01/08 09:30:04.0078 MxlW2k (a1520761f42dbb06db7929d6fa9753ea) C:\WINDOWS\system32\drivers\MxlW2k.sys
2011/01/08 09:30:04.0343 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/01/08 09:30:04.0625 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys
2011/01/08 09:30:04.0890 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/01/08 09:30:05.0171 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/01/08 09:30:05.0437 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/01/08 09:30:05.0718 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/01/08 09:30:06.0000 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/01/08 09:30:06.0281 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/01/08 09:30:06.0531 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/01/08 09:30:06.0953 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys
2011/01/08 09:30:07.0421 NPPTNT (074e989e9ea12230a9a44df435d30a39) C:\WINDOWS\System32\npptNT.sys
2011/01/08 09:30:07.0734 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/01/08 09:30:08.0203 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/01/08 09:30:08.0453 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/01/08 09:30:08.0734 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/01/08 09:30:09.0000 Parport (29744eb4ce659dfe3b4122deb45bc478) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/01/08 09:30:09.0281 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/01/08 09:30:09.0562 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/01/08 09:30:10.0078 PCI (8086d9979234b603ad5bc2f5d890b234) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/01/08 09:30:10.0593 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\System32\DRIVERS\pciide.sys
2011/01/08 09:30:10.0890 Pcmcia (82a087207decec8456fbe8537947d579) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/01/08 09:30:12.0671 pnarp (ce27fc8bdc54b3ac63d53e2d5f6cc929) C:\WINDOWS\system32\DRIVERS\pnarp.sys
2011/01/08 09:30:12.0953 pnpcap (429e80e63d78c131f30e62d657e2735a) C:\WINDOWS\system32\DRIVERS\pnpcap.sys
2011/01/08 09:30:13.0234 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/01/08 09:30:13.0484 Processor (0d97d88720a4087ec93af7dbb303b30a) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/01/08 09:30:13.0828 Ps2 (9b793a1ffd480155fe9ee5261153f21b) C:\WINDOWS\system32\DRIVERS\PS2.sys
2011/01/08 09:30:14.0125 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/01/08 09:30:14.0406 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/01/08 09:30:14.0687 purendis (f4fd591e86ecb6b5d000c7d6c987416b) C:\WINDOWS\system32\DRIVERS\purendis.sys
2011/01/08 09:30:14.0968 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\DRIVERS\PxHelp20.sys
2011/01/08 09:30:15.0234 QCDonner (fddd1aeb9f81ef1e6e48ae1edc2a97d6) C:\WINDOWS\system32\DRIVERS\OVCD.sys
2011/01/08 09:30:16.0656 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/01/08 09:30:16.0953 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys
2011/01/08 09:30:17.0203 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/01/08 09:30:17.0500 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/01/08 09:30:17.0781 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/01/08 09:30:18.0062 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/01/08 09:30:18.0343 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/01/08 09:30:18.0656 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/01/08 09:30:18.0968 redbook (b31b4588e4086d8d84adbf9845c2402b) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/01/08 09:30:19.0234 RimUsb (f17713d108aca124a139fde877eef68a) C:\WINDOWS\system32\Drivers\RimUsb.sys
2011/01/08 09:30:19.0500 RimVSerPort (2c4fb2e9f039287767c384e46ee91030) C:\WINDOWS\system32\DRIVERS\RimSerial.sys
2011/01/08 09:30:19.0796 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
2011/01/08 09:30:20.0140 RT73 (da4980fad2b7d86d6ed8e35e3874f65e) C:\WINDOWS\system32\DRIVERS\rt73.sys
2011/01/08 09:30:20.0453 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS
2011/01/08 09:30:20.0734 RTLWUSB (c3880bf1bad0b8eb69efb07a9c3fa7d9) C:\WINDOWS\system32\DRIVERS\wg111v2.sys
2011/01/08 09:30:21.0015 S3Psddr (0dbcc071a268e0340a2ba6bdd98bace4) C:\WINDOWS\system32\DRIVERS\s3gnbm.sys
2011/01/08 09:30:21.0218 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
2011/01/08 09:30:21.0312 SASENUM (7ce61c25c159f50f9eaf6d77fc83fa35) C:\Program Files\SUPERAntiSpyware\SASENUM.SYS
2011/01/08 09:30:21.0421 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys
2011/01/08 09:30:21.0734 SCDEmu (e9bbd87afd80dc1212ecd762858b45c7) C:\WINDOWS\system32\drivers\SCDEmu.sys
2011/01/08 09:30:22.0062 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/01/08 09:30:22.0375 Serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/01/08 09:30:22.0640 Serial (cd9404d115a00d249f70a371b46d5a26) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/01/08 09:30:22.0984 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/01/08 09:30:23.0515 SjyPkt (3d7ef286e806f9bd9339aa52e28dcd67) C:\WINDOWS\System32\Drivers\SjyPkt.sys
2011/01/08 09:30:23.0796 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/01/08 09:30:24.0109 SNDO763 (c02a3d8fe92461db6b26a2aa2ba4fe33) C:\WINDOWS\system32\DRIVERS\sndo763.sys
2011/01/08 09:30:24.0375 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS
2011/01/08 09:30:24.0859 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys
2011/01/08 09:30:25.0171 sptd (7f1b7c4d446cd3f926af45b8c48bd593) C:\WINDOWS\system32\Drivers\sptd.sys
2011/01/08 09:30:25.0171 Suspicious file (NoAccess): C:\WINDOWS\system32\Drivers\sptd.sys. md5: 7f1b7c4d446cd3f926af45b8c48bd593
2011/01/08 09:30:25.0218 sptd - detected Locked file (1)
2011/01/08 09:30:25.0453 sr (e41b6d037d6cd08461470af04500dc24) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/01/08 09:30:25.0796 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/01/08 09:30:26.0093 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/01/08 09:30:26.0359 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/01/08 09:30:26.0640 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys
2011/01/08 09:30:27.0890 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/01/08 09:30:28.0234 Tcpip (3c966f647bab332093cb0f92692b5cb8) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/01/08 09:30:28.0531 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/01/08 09:30:28.0828 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/01/08 09:30:29.0156 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/01/08 09:30:29.0500 tmcomm (df8444a8fa8fd38d8848bdd40a8403b3) C:\WINDOWS\system32\drivers\tmcomm.sys
2011/01/08 09:30:30.0046 TVICHW32 (e266683fc95abdec17cd378564e1b54b) C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS
2011/01/08 09:30:30.0328 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys
2011/01/08 09:30:30.0828 ultradfg (4133cb081b4a1add79cc2dcf2f0b5744) C:\WINDOWS\system32\DRIVERS\ultradfg.sys
2011/01/08 09:30:31.0125 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS\system32\DRIVERS\update.sys
2011/01/08 09:30:31.0515 USBAAPL (60a68a5ea173a97971ee9f1ff49eb2b3) C:\WINDOWS\system32\Drivers\usbaapl.sys
2011/01/08 09:30:31.0796 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/01/08 09:30:32.0078 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/01/08 09:30:32.0343 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/01/08 09:30:32.0609 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/01/08 09:30:32.0906 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys
2011/01/08 09:30:33.0171 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/01/08 09:30:33.0453 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/01/08 09:30:33.0812 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys
2011/01/08 09:30:34.0062 viaagp1 (0e3e3fae3a0a58b8d936a8e841a17d16) C:\WINDOWS\system32\DRIVERS\viaagp1.sys
2011/01/08 09:30:34.0343 ViaIde (59cb1338ad3654417bea49636457f65d) C:\WINDOWS\System32\DRIVERS\viaide.sys
2011/01/08 09:30:34.0625 VolSnap (ee4660083deba849ff6c485d944b379b) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/01/08 09:30:34.0953 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/01/08 09:30:35.0234 WDC_SAM (d6efaf429fd30c5df613d220e344cce7) C:\WINDOWS\system32\DRIVERS\wdcsam.sys
2011/01/08 09:30:35.0781 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/01/08 09:30:36.0343 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\Drivers\wpdusb.sys
2011/01/08 09:30:36.0625 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/01/08 09:30:36.0921 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/01/08 09:30:37.0218 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/01/08 09:30:37.0500 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/01/08 09:30:37.0890 {6080A529-897E-4629-A488-ABA0C29B635E} (3ee36328e860fbf102b54608a055c6be) C:\WINDOWS\system32\drivers\ialmsbw.sys
2011/01/08 09:30:38.0187 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91} (17f39a1916733ed228eb46ad67c35426) C:\WINDOWS\system32\drivers\ialmkchw.sys
2011/01/08 09:30:38.0421 ================================================================================
2011/01/08 09:30:38.0421 Scan finished
2011/01/08 09:30:38.0421 ================================================================================
2011/01/08 09:30:38.0468 Detected object count: 2
2011/01/08 09:31:55.0062 Disk (edc0b2042697da1212782d4260c3ac9b) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/01/08 09:31:55.0062 Suspicious file (Forged): C:\WINDOWS\system32\DRIVERS\disk.sys. Real md5: edc0b2042697da1212782d4260c3ac9b, Fake md5: 00ca44e4534865f8a3b64f7c0984bff0
2011/01/08 09:31:55.0828 Backup copy found, using it..
2011/01/08 09:31:55.0875 C:\WINDOWS\system32\DRIVERS\disk.sys - will be cured after reboot
2011/01/08 09:31:55.0875 Rootkit.Win32.TDSS.tdl3(Disk) - User select action: Cure
2011/01/08 09:31:55.0890 Locked file(sptd) - User select action: Skip
2011/01/08 09:32:04.0218 Deinitialize success

OTL Logs:
OTL.txt
——————
OTL logfile created on: 1/8/2011 9:36:16 AM - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,015.00 Mb Total Physical Memory | 705.00 Mb Available Physical Memory | 69.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 33.35 Gb Total Space | 2.89 Gb Free Space | 8.67% Space Free | Partition Type: NTFS
Drive D: | 3.90 Gb Total Space | 1.28 Gb Free Space | 32.72% Space Free | Partition Type: FAT32
Drive F: | 465.68 Gb Total Space | 446.06 Gb Free Space | 95.79% Space Free | Partition Type: FAT32
Drive G: | 111.76 Gb Total Space | 20.50 Gb Free Space | 18.34% Space Free | Partition Type: FAT32

Computer Name: YOUR-B79WZ4ROSE | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\COMODO\Firewall\cmdagent.exe ()
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
PRC - C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\Runservice.exe ()

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\guard32.dll ()
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (SandraTheSrv) – F:\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe File not found
SRV - (SandraDataSrv) – F:\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe File not found
SRV - (Imapi Helper) – F:\isoburener\ImapiHelper.exe File not found
SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (WDFME) – C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe ()
SRV - (WDSC) – C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe ()
SRV - (WDDMService) – C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC)
SRV - (cmdAgent) – C:\Program Files\COMODO\Firewall\cmdagent.exe ()
SRV - (nmservice) – C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
SRV - (TuneUp.Defrag) – C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software GmbH)
SRV - (UxTuneUp) – C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (LicCtrlService) – C:\WINDOWS\Runservice.exe ()
SRV - (GEARSecurity) – C:\WINDOWS\system32\gearsec.exe (GEAR Software)

========== Driver Services (SafeList) ==========

DRV - (dump_wmimmc) – F:\gunbound\Gunbound Revolution\GameGuard\dump_wmimmc.sys File not found
DRV - (epmntdrv) – C:\WINDOWS\system32\epmntdrv.sys ()
DRV - (EuGdiDrv) – C:\WINDOWS\system32\EuGdiDrv.sys ()
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (Inspect) – C:\WINDOWS\System32\DRIVERS\inspect.sys (COMODO)
DRV - (cmdGuard) – C:\WINDOWS\system32\drivers\cmdguard.sys (COMODO)
DRV - (cmdHlp) – C:\WINDOWS\system32\drivers\cmdhlp.sys (COMODO)
DRV - (WDC_SAM) – C:\WINDOWS\system32\drivers\wdcsam.sys (Western Digital Technologies)
DRV - (pnpcap) – C:\WINDOWS\system32\drivers\pnpcap.sys (Cisco Systems, Inc.)
DRV - (purendis) – C:\WINDOWS\system32\drivers\purendis.sys (Cisco Systems, Inc.)
DRV - (pnarp) – C:\WINDOWS\system32\drivers\pnarp.sys (Cisco Systems, Inc.)
DRV - (MxlW2k) – C:\WINDOWS\System32\drivers\MxlW2k.sys (MusicMatch, Inc.)
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (SCDEmu) – C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (ultradfg) – C:\WINDOWS\system32\drivers\ultradfg.sys (DASoft Development Team)
DRV - (RTLWUSB) – C:\WINDOWS\system32\drivers\wg111v2.sys (NETGEAR Inc.)
DRV - (tmcomm) – C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (RT73) – C:\WINDOWS\system32\drivers\rt73.sys (Ralink Technology, Corp.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\rtl8139.sys (Realtek Semiconductor Corporation)
DRV - (S3Psddr) – C:\WINDOWS\system32\drivers\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (SNDO763) – C:\WINDOWS\system32\drivers\sndo763.sys ()
DRV - (ALCXSENS) – C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura Ltd)
DRV - (NPPTNT) – C:\WINDOWS\system32\npptNT.sys (INCA Internet Co., Ltd.)
DRV - (ltmodem5) – C:\WINDOWS\system32\drivers\ltmdmnt.sys (LT)
DRV - (viaagp1) – C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (SjyPkt) – C:\WINDOWS\system32\drivers\SjyPkt.sys (Windows ® 2000 DDK provider)
DRV - (Ps2) – C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)
DRV - (DCamUSBVeo532) – C:\WINDOWS\system32\drivers\ubVeo532.sys (IC Media Corporation)
DRV - (IPFilter) – C:\WINDOWS\system32\drivers\ipfilter.sys (Microsoft Corporation)
DRV - (irsir) – C:\WINDOWS\system32\drivers\irsir.sys (Microsoft Corporation)
DRV - (DTC328X) – C:\WINDOWS\System32\drivers\DTC328X.SYS (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Data = C3 17 11 E0 B2 A4 AC 29 3E F1 D7 B3 41 B1 26 5E 77 7F FB 0D C7 48 7E BE 12 BE E1 AD BE 28 [binary data]
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:1.10
FF - prefs.js..extensions.enabledItems: [removed]:0.20
FF - prefs.js..extensions.enabledItems: {567F62D2-2162-43fe-A573-E5620D0934B2}:1.6
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.08
FF - prefs.js..extensions.enabledItems: {F5CEF9AD-F6AF-4b69-AB6D-936BF6BCB6D7}:1.5
FF - prefs.js..network.proxy.type: 4

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealOne Player\browserrecord [2008/05/17 03:31:46 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/11 16:25:34 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/10 18:47:59 | 000,000,000 | —D | M]

[2008/06/20 19:15:11 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2011/01/07 19:33:34 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\pbf9imzw.default\extensions
[2010/04/27 19:04:03 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\pbf9imzw.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2008/03/09 13:27:08 | 000,000,000 | —D | M] (MidnightFox) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\pbf9imzw.default\extensions\{66871bd1-5ba2-4739-b485-2a15f5969bd8}(2)
[2011/01/07 19:33:34 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) – C:\PROGRAM FILES\COMETBIRD\EXTENSIONS\{567F62D2-2162-43FE-A573-E5620D0934B2}
File not found (No name found) – C:\PROGRAM FILES\COMETBIRD\EXTENSIONS\{B042753D-F57E-4E8E-A01B-7379A6D4CEFB}
File not found (No name found) – C:\PROGRAM FILES\COMETBIRD\EXTENSIONS\{F5CEF9AD-F6AF-4B69-AB6D-936BF6BCB6D7}
File not found (No name found) – C:\PROGRAM FILES\COMETBIRD\EXTENSIONS\[removed]
File not found (No name found) – C:\PROGRAM FILES\COMETBIRD\EXTENSIONS\[removed]
[2010/08/24 04:31:30 | 000,773,120 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2007/07/25 03:51:06 | 000,164,352 | —- | M] (Indiepath Ltd) – C:\Program Files\Mozilla Firefox\plugins\npigl.dll
[2009/05/20 00:49:50 | 000,083,376 | —- | M] (NHN USA Inc.) – C:\Program Files\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll
[2009/05/27 15:41:50 | 000,069,632 | —- | M] (NHN USA Inc. ) – C:\Program Files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
[2007/04/16 12:07:12 | 000,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

Hosts file not found
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Player\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\BitComet\tools\BitCometBHO_1.4.11.9.dll (BitComet)
O2 - BHO: (ST) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll (Microsoft Corporation)
O2 - BHO: (MSNToolBandBHO) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (Microsoft Corporation)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (MSN) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (&Yahoo;! Companion) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {40D41A8B-D79B-43D7-99A7-9EE0F344C385} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (MSN) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Yahoo;! Companion) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll (Yahoo! Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &D;&ownload; &with; BitComet - G:\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D;&ownload; all video with BitComet - G:\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D;&ownload; all with BitComet - G:\BitComet\BitComet.exe (www.BitComet.com)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe File not found
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe File not found
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\BitComet\tools\BitCometBHO_1.4.11.9.dll (BitComet)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\NewDotNet\newdotnet6_38.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll File not found
O15 - HKCU\..Trusted Ranges: Range1979 ([http] in Trusted sites)
O16 - DPF: {00000075-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/voxacm.CAB (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab (Yahoo! Audio Conferencing)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} http://download.yahoo.com/dl/installs/yinst0401.cab (YInstStarter Class)
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} http://chat.yahoo.com/cab/yacsui.cab (Yahoo! Audio UI1)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/…7811.3900810185 (Reg Error: Key error.)
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll (Reg Error: Key error.)
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} http://www.crucial.com/controls/cpcScanner.cab (Crucial cpcScan)
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} http://fdl.msn.com/zone/datafiles/heartbeat.cab (HeartbeatCtl Class)
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} http://www.srtest.com/sysreqlab.cab (System Requirements Lab Class)
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} http://java.sun.com/products/plugin/1.4/ji…indows-i586.cab (Java Plug-in 1.4.1_02)
O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://l.yimg.com/jh/games/web_games/popca…aploader_v6.cab (Reg Error: Key error.)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: JT's Blocks http://download.games.yahoo.com/games/clients/y/blt1_x.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: Yahoo! Chat http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab (Reg Error: Key error.)
O16 - DPF: Yahoo! Poker http://download.games.yahoo.com/games/clients/y/pt0_x.cab (Reg Error: Key error.)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (RtlGina2.dll) - C:\WINDOWS\System32\RtlGina2.dll ()
O20 - HKLM Winlogon: UIHost - (C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe) - C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\dimsntfy: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O20 - Winlogon\Notify\khfffdb: DllName - khfffdb.dll - File not found
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O29 - HKLM SecurityProviders - (zwebauth.dll) - C:\WINDOWS\System32\ZWebAuth.dll ()
O29 - HKLM SecurityProviders - (zpasspc.dll) - C:\WINDOWS\System32\zpasspc.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/02/26 14:49:14 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 06:07:38 | 000,000,000 | RHS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2002/09/11 03:02:32 | 000,000,045 | -HS- | M] () - D:\Autorun.inf – [ FAT32 ]
O32 - AutoRun File - [2002/10/17 09:56:50 | 000,000,036 | RH– | M] () - G:\autorun.inf – [ FAT32 ]
O32 - AutoRun File - [2002/10/28 13:03:12 | 000,000,000 | RH-D | M] - G:\autorun – [ FAT32 ]
O32 - AutoRun File - [2005/09/20 16:15:32 | 000,009,473 | —- | M] () - G:\Autoexec1.cfg – [ FAT32 ]
O32 - AutoRun File - [2005/10/07 20:20:10 | 000,009,813 | —- | M] () - G:\Autoexec.cfg – [ FAT32 ]
O33 - MountPoints2\{16417dcc-6f59-11df-818d-00402b634c86}\Shell - "" = AutoRun
O33 - MountPoints2\{16417dcc-6f59-11df-818d-00402b634c86}\Shell\Auto\command - "" = F:\Server.exe – File not found
O33 - MountPoints2\{16417dcc-6f59-11df-818d-00402b634c86}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{3dfaf873-5083-11de-8147-00d041af2cb3}\Shell\AutoRun\command - "" = F:\RECYCLER\k-1-3542-4232123213-7676767-8888886\hn.exe – File not found
O33 - MountPoints2\{3dfaf873-5083-11de-8147-00d041af2cb3}\Shell\open\command - "" = F:\RECYCLER\k-1-3542-4232123213-7676767-8888886\hn.exe – File not found
O33 - MountPoints2\{6bc16841-6856-11db-8057-000fb5d8bcd0}\Shell\AutoRun\command - "" = G:\JDSecure\Windows\JDSecure31.exe – File not found
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\Info.exe – [2002/09/10 21:54:58 | 000,040,960 | -HS- | M] (XSS)
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - C:\WINDOWS\System32\appmgmts.dll File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: UxTuneUp - C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software GmbH)
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\System32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: msacm.voxacm160 - C:\WINDOWS\System32\vct3216.acm (Voxware, Inc.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (74041529626263552)

========== Files/Folders - Created Within 30 Days ==========

[2011/01/08 09:28:55 | 001,345,624 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\TDSSKiller.exe
[2011/01/07 22:14:56 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/01/06 00:04:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\SRWare Iron
[2011/01/06 00:04:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Chromium
[2011/01/06 00:04:35 | 000,000,000 | —D | C] – C:\Program Files\SRWare Iron
[2011/01/05 01:45:56 | 000,061,440 | —- | C] (Windswept Software) – C:\WINDOWS\System32\digitbox.ocx
[2011/01/05 01:45:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Alarm
[2011/01/05 01:45:55 | 000,000,000 | —D | C] – C:\Program Files\Alarm
[2011/01/02 23:02:01 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2011/01/02 22:52:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Temp
[2011/01/02 17:51:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Start Menu\Programs\Simple Port Forwarding
[2011/01/02 17:51:19 | 000,000,000 | —D | C] – C:\WINDOWS\Simple Port Forwarding
[2011/01/02 17:51:18 | 000,000,000 | —D | C] – C:\Program Files\Simple Port Forwarding
[2011/01/02 17:37:20 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2011/01/02 17:06:27 | 000,000,000 | —D | C] – C:\Program Files\Google
[2011/01/02 17:06:19 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
[2011/01/02 17:05:29 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Lavasoft
[2011/01/02 17:05:28 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2011/01/02 16:55:43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/01/02 16:55:33 | 004,622,344 | —- | C] (AVG Technologies) – C:\Documents and Settings\Owner\My Documents\avg_free_stb_all_2011_1191_cnet.exe
[2011/01/02 14:10:34 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Malwarebytes
[2011/01/02 14:10:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/01/02 14:10:04 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/01/02 14:10:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/01/02 14:09:52 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/01/02 14:09:51 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/12/21 23:14:56 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\FKRMonitor
[2010/12/21 23:14:52 | 000,000,000 | —D | C] – C:\Program Files\FKRMonitor
[2004/12/25 10:18:20 | 000,036,864 | —- | C] ( ) – C:\WINDOWS\System32\vsndo763.dll
[7 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
[265 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/01/08 09:34:11 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/01/08 09:34:09 | 000,000,801 | -HS- | M] () – C:\WINDOWS\System32\mmf.sys
[2011/01/08 09:33:56 | 000,000,486 | —- | M] () – C:\WINDOWS\tasks\1-Click Maintenance.job
[2011/01/08 09:33:47 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/01/08 09:28:24 | 001,232,020 | —- | M] () – C:\Documents and Settings\Owner\Desktop\tdsskiller.zip
[2011/01/08 09:02:04 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/01/08 09:01:16 | 000,000,234 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/01/08 01:54:13 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/01/07 22:36:58 | 000,359,929 | —- | M] () – C:\Documents and Settings\Owner\Desktop\dds.scr
[2011/01/07 22:15:47 | 000,000,460 | RHS- | M] () – C:\boot.ini
[2011/01/07 22:14:51 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/01/06 00:04:53 | 000,000,687 | —- | M] () – C:\Documents and Settings\All Users\Desktop\SRWare Iron.lnk
[2011/01/05 01:45:56 | 000,000,686 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Alarm.lnk
[2011/01/02 21:44:15 | 000,000,833 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Shortcut to Heroes3.exe.lnk
[2011/01/02 17:51:34 | 000,001,641 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Simple Port Forwarding.lnk
[2011/01/02 17:06:17 | 000,000,893 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2011/01/02 17:06:17 | 000,000,875 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2011/01/02 16:55:35 | 004,622,344 | —- | M] (AVG Technologies) – C:\Documents and Settings\Owner\My Documents\avg_free_stb_all_2011_1191_cnet.exe
[2011/01/02 14:10:07 | 000,000,792 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/01/01 11:11:00 | 000,000,600 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Opera.lnk
[2010/12/20 18:09:00 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/12/16 09:47:52 | 001,345,624 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\TDSSKiller.exe
[2010/12/14 23:48:43 | 000,095,744 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/14 22:02:20 | 000,000,256 | —- | M] () – C:\WINDOWS\System32\pool.bin
[2010/12/14 20:37:30 | 005,165,625 | —- | M] () – C:\Documents and Settings\Owner\My Documents\LoaderBackup-(2010-12-14).ipd
[2010/12/14 20:28:59 | 005,135,070 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Backup-(2010-12-14).ipd
[2010/12/10 18:48:00 | 000,000,478 | —- | M] () – C:\Documents and Settings\Owner\Desktop\danettaclasses.doc
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]
[265 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/01/08 09:28:30 | 001,232,020 | —- | C] () – C:\Documents and Settings\Owner\Desktop\tdsskiller.zip
[2011/01/07 22:37:08 | 000,359,929 | —- | C] () – C:\Documents and Settings\Owner\Desktop\dds.scr
[2011/01/06 00:04:53 | 000,000,687 | —- | C] () – C:\Documents and Settings\All Users\Desktop\SRWare Iron.lnk
[2011/01/05 01:45:56 | 000,000,686 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Alarm.lnk
[2011/01/02 22:57:28 | 000,000,886 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/01/02 21:44:15 | 000,000,833 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Shortcut to Heroes3.exe.lnk
[2011/01/02 17:51:34 | 000,001,641 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Simple Port Forwarding.lnk
[2011/01/02 17:12:09 | 000,000,880 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/01/02 17:06:17 | 000,000,893 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2011/01/02 17:06:17 | 000,000,875 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2011/01/02 14:10:07 | 000,000,792 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/14 20:37:29 | 005,165,625 | —- | C] () – C:\Documents and Settings\Owner\My Documents\LoaderBackup-(2010-12-14).ipd
[2010/12/14 20:28:59 | 005,135,070 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Backup-(2010-12-14).ipd
[2010/11/26 19:06:03 | 000,014,848 | —- | C] () – C:\WINDOWS\System32\EuEpmGdi.dll
[2010/11/26 19:06:03 | 000,013,192 | —- | C] () – C:\WINDOWS\System32\epmntdrv.sys
[2010/11/26 19:06:03 | 000,008,456 | —- | C] () – C:\WINDOWS\System32\EuGdiDrv.sys
[2010/11/26 17:52:58 | 000,106,264 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/06/04 22:37:33 | 008,673,792 | —- | C] () – C:\Documents and Settings\All Users\Application Data\atscie.msi
[2008/05/31 19:12:11 | 002,144,487 | —- | C] () – C:\WINDOWS\_005551_.tmp.dll
[2008/05/31 19:12:02 | 000,010,027 | —- | C] () – C:\WINDOWS\_005552_.tmp.dll
[2008/05/31 19:11:55 | 000,026,991 | —- | C] () – C:\WINDOWS\_005554_.tmp.dll
[2008/05/31 19:11:55 | 000,012,363 | —- | C] () – C:\WINDOWS\_005555_.tmp.dll
[2008/05/31 19:11:17 | 000,402,264 | —- | C] () – C:\WINDOWS\_005560_.tmp.dll
[2008/04/16 10:24:14 | 000,716,272 | —- | C] () – C:\WINDOWS\System32\drivers\sptd.sys
[2008/03/31 21:42:39 | 000,155,384 | —- | C] () – C:\WINDOWS\System32\guard32.dll
[2008/03/09 16:02:43 | 000,000,067 | —- | C] () – C:\WINDOWS\AVIConverter.INI
[2008/03/09 06:26:20 | 000,091,648 | —- | C] () – C:\WINDOWS\System32\lua5.1a.dll
[2008/01/12 00:27:59 | 000,001,357 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/12/10 02:03:11 | 000,034,308 | —- | C] () – C:\WINDOWS\System32\BASSMOD.dll
[2007/08/09 13:37:05 | 000,043,520 | —- | C] () – C:\WINDOWS\System32\CmdLineExt03.dll
[2007/08/03 23:37:36 | 000,000,021 | —- | C] () – C:\WINDOWS\atid.ini
[2007/01/15 13:24:28 | 000,000,180 | —- | C] () – C:\WINDOWS\dellstat.ini
[2007/01/15 13:24:25 | 000,000,389 | —- | C] () – C:\WINDOWS\lexstat.ini
[2007/01/15 13:23:35 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxczvs.dll
[2007/01/15 13:22:31 | 000,000,270 | —- | C] () – C:\WINDOWS\System32\lxczcoin.ini
[2006/05/03 17:44:32 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\RtlGina2.dll
[2005/10/05 14:57:26 | 000,000,121 | —- | C] () – C:\Program Files\ppunistall.bat
[2005/02/24 02:00:59 | 000,000,044 | —- | C] () – C:\WINDOWS\liveup.ini
[2005/02/02 02:53:23 | 000,000,784 | —- | C] () – C:\Documents and Settings\Owner\Application Data\mpauth.dat
[2005/01/27 00:33:46 | 000,012,288 | —- | C] () – C:\WINDOWS\impborl.dll
[2005/01/03 01:07:42 | 000,000,026 | —- | C] () – C:\WINDOWS\ulead32.ini
[2004/12/25 11:46:29 | 000,000,071 | —- | C] () – C:\WINDOWS\pex.INI
[2004/12/25 10:18:21 | 000,233,472 | —- | C] () – C:\WINDOWS\System32\sndo763.dll
[2004/12/25 10:18:21 | 000,218,112 | —- | C] () – C:\WINDOWS\System32\drivers\sndo763.sys
[2004/12/25 10:18:21 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\dsndo763.dll
[2004/12/25 10:18:21 | 000,015,522 | —- | C] () – C:\WINDOWS\sndo763.ini
[2004/12/07 01:43:48 | 000,000,056 | RHS- | C] () – C:\WINDOWS\System32\18E2FC8E4C.sys
[2004/05/19 12:09:11 | 000,000,508 | —- | C] () – C:\WINDOWS\SIERRA.INI
[2004/05/09 07:23:37 | 000,000,226 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/03/07 21:23:27 | 000,000,050 | —- | C] () – C:\WINDOWS\System32\MSrev01.dll
[2004/03/07 20:03:36 | 000,000,854 | —- | C] () – C:\WINDOWS\entpack.ini
[2004/02/03 23:56:49 | 000,000,026 | —- | C] () – C:\WINDOWS\System32\MSrev21.dll
[2004/02/03 23:56:45 | 000,000,093 | —- | C] () – C:\WINDOWS\System32\MSrev41.dll
[2004/01/03 17:01:13 | 000,000,633 | —- | C] () – C:\WINDOWS\fantasy2.ini
[2004/01/03 17:01:13 | 000,000,207 | —- | C] () – C:\WINDOWS\videoimp.ini
[2004/01/03 17:01:12 | 000,000,113 | —- | C] () – C:\WINDOWS\photoimpression.ini
[2004/01/03 17:00:54 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2003/12/25 11:38:55 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\Veo532ut.dll
[2003/12/25 11:38:55 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\VeoSetup532.dll
[2003/12/19 15:00:48 | 000,000,801 | -HS- | C] () – C:\WINDOWS\System32\mmf.sys
[2003/12/19 15:00:48 | 000,000,801 | -HS- | C] () – C:\WINDOWS\System32\mmf(2)(2).sys
[2003/12/19 15:00:46 | 000,045,056 | —- | C] () – C:\WINDOWS\mmfs.dll
[2003/12/05 17:15:04 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/12/05 17:14:59 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\devenum(2).dll
[2003/11/23 20:10:30 | 000,000,402 | —- | C] () – C:\WINDOWS\Belt.ini
[2003/11/19 19:06:05 | 000,000,804 | —- | C] () – C:\WINDOWS\System32\ncase.ini
[2003/10/04 14:43:58 | 000,021,840 | —- | C] () – C:\WINDOWS\System32\SIntfNT.dll
[2003/10/04 14:43:58 | 000,017,212 | —- | C] () – C:\WINDOWS\System32\SIntf32.dll
[2003/10/04 14:43:58 | 000,012,067 | —- | C] () – C:\WINDOWS\System32\SIntf16.dll
[2003/08/23 09:59:24 | 000,046,512 | —- | C] () – C:\WINDOWS\System32\EPSN.DLL
[2003/08/23 09:59:24 | 000,011,934 | —- | C] () – C:\WINDOWS\System32\PIXPNR.DLL
[2003/08/23 09:59:23 | 000,012,126 | —- | C] () – C:\WINDOWS\System32\PIXPCZ.DLL
[2003/08/23 09:51:52 | 000,046,592 | —- | C] () – C:\WINDOWS\System32\WNASPI32.DLL
[2003/08/21 13:43:37 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2003/08/07 20:35:11 | 000,016,973 | —- | C] () – C:\WINDOWS\System32\ZWebAuth.dll
[2003/07/11 21:37:22 | 000,008,379 | —- | C] () – C:\WINDOWS\cdPlayer.ini
[2003/07/11 19:57:03 | 000,000,632 | —- | C] () – C:\WINDOWS\Qiii.INI
[2003/07/09 11:36:51 | 000,001,125 | —- | C] () – C:\WINDOWS\winamp.ini
[2003/07/08 22:30:05 | 000,095,744 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2003/07/08 21:49:41 | 000,000,344 | —- | C] () – C:\WINDOWS\QTW.INI
[2003/07/08 17:49:06 | 000,000,088 | —- | C] () – C:\WINDOWS\odbc.ini
[2003/07/07 10:07:55 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\iAlmcoin.dll
[2003/05/30 08:00:02 | 001,246,208 | —- | C] () – C:\WINDOWS\System32\quartz(2).dll
[2003/04/28 22:12:02 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/04/26 02:05:29 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2003/04/26 02:02:53 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\syscontr.dll
[2003/04/26 02:02:52 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2003/04/26 01:34:11 | 000,000,052 | —- | C] () – C:\WINDOWS\intuprof.ini
[2003/04/26 01:34:01 | 000,000,626 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2003/04/26 01:18:01 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2003/04/26 00:53:15 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2003/04/26 00:53:15 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2003/04/26 00:52:58 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2003/04/26 00:37:56 | 000,000,802 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/04/26 00:24:49 | 000,000,552 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/04/25 17:28:36 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2003/03/01 02:47:30 | 000,158,790 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\SVGAbout001.svg
[2002/12/12 09:14:32 | 000,013,312 | —- | C] () – C:\WINDOWS\System32\msdmo(2).dll
[2002/10/03 13:42:27 | 000,000,034 | —- | C] () – C:\WINDOWS\Q3version.ini
[2002/08/20 19:37:50 | 000,093,696 | —- | C] () – C:\WINDOWS\System32\zlib.dll
[2002/04/11 13:47:52 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\msmscoin.dll
[2001/01/01 20:40:20 | 000,249,270 | —- | C] () – C:\WINDOWS\System32\_006024_.tmp.dll
[2001/01/01 20:20:44 | 000,022,040 | —- | C] () – C:\WINDOWS\System32\_005992_.tmp.dll
[1999/12/02 18:45:46 | 000,046,864 | —- | C] () – C:\WINDOWS\System32\zoneauth.dll

========== LOP Check ==========

[2008/12/30 22:11:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\acccore
[2008/06/17 12:52:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Age of Empires 3
[2009/11/12 20:30:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AIM
[2008/01/08 12:14:09 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\avg7
[2009/06/26 18:56:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ijjigame
[2011/01/02 16:55:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2010/01/08 15:42:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Research In Motion
[2008/03/31 21:37:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2004/12/25 10:30:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Ulead Systems
[2008/12/30 22:11:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2010/11/26 17:03:43 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Western Digital
[2011/01/02 17:06:21 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
[2009/05/23 14:32:00 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2003/03/19 15:59:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{E6336151-EF41-464A-8B64-FB8DDD606AB4}
[2007/08/03 23:50:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\acccore
[2008/04/16 10:48:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Aim
[2009/03/21 18:10:58 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Audacity
[2008/01/08 08:00:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\AVG7
[2010/11/26 17:06:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\BitComet
[2007/10/26 18:36:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Blackberry Desktop
[2009/04/17 09:14:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\CometNetwork
[2010/12/21 23:16:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\FKRMonitor
[2008/03/09 12:58:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\GetRightToGo
[2008/04/11 16:33:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\HouseCall 6.6
[2010/01/02 23:25:19 | 000,000,000 | -H-D | M] – C:\Documents and Settings\Owner\Application Data\ijjigame
[2008/04/16 17:17:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Leadertech
[2003/11/17 21:05:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Lycos
[2007/11/12 23:59:14 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Netscape
[2008/06/22 16:15:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Opera
[2008/03/09 13:27:10 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Phone Warn
[2008/12/30 22:15:30 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\QQ Games Plugin
[2007/10/26 19:30:16 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Research In Motion
[2003/04/26 02:01:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SampleView
[2006/01/07 17:51:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\SlySoft
[2009/05/23 22:23:03 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\TeamViewer
[2003/07/14 14:29:24 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Template
[2008/12/30 22:14:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Tencent
[2008/03/31 21:38:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\TuneUp Software
[2004/12/25 11:45:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Ulead Systems
[2006/01/27 16:44:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\uTorrent
[2007/08/04 00:01:46 | 000,000,000 | —D | M] – C:\Documents and Settings\Owner\Application Data\Viewpoint
[2011/01/08 09:33:56 | 000,000,486 | —- | M] () – C:\WINDOWS\Tasks\1-Click Maintenance.job
[2011/01/08 01:54:13 | 000,000,330 | -H– | M] () – C:\WINDOWS\Tasks\MP Scheduled Scan.job
[2011/01/08 09:01:16 | 000,000,234 | —- | M] () – C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2003/02/26 14:49:14 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2003/07/07 10:04:24 | 000,000,196 | RHS- | M] () – C:\BOOT.BAK
[2011/01/07 22:15:47 | 000,000,460 | RHS- | M] () – C:\boot.ini
[2002/08/29 07:00:00 | 000,245,920 | RHS- | M] () – C:\cmldr
[2003/02/26 14:49:14 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2003/07/08 17:46:45 | 000,000,185 | —- | M] () – C:\DAOsetup.log
[2004/07/15 05:16:18 | 000,000,113 | —- | M] () – C:\DownloadLog.txt
[2008/04/07 07:07:14 | 000,099,670 | —- | M] () – C:\FRAGLIST.LUAR
[2003/03/15 21:33:30 | 000,043,967 | —- | M] () – C:\hpfr3420.log
[2003/03/15 21:33:28 | 000,000,000 | —- | M] () – C:\hpfr3420.xml
[2003/02/26 14:49:14 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2009/11/12 20:30:44 | 000,003,568 | -H– | M] () – C:\IPH.PH
[2007/08/06 15:05:34 | 000,003,558 | —- | M] () – C:\isorecorder.log
[2005/01/11 01:10:41 | 000,001,168 | —- | M] () – C:\kasi.txt
[2003/02/26 14:49:14 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2007/07/25 03:51:06 | 000,164,352 | —- | M] (Indiepath Ltd) – C:\npigl.dll
[2007/02/09 08:55:54 | 000,000,283 | —- | M] () – C:\npigl.xpt
[2005/10/18 22:58:04 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/05/31 20:27:10 | 000,250,032 | RHS- | M] () – C:\ntldr
[2005/09/06 15:42:16 | 000,024,204 | —- | M] () – C:\outfile.jpg
[2011/01/08 09:33:44 | 1610,612,736 | -HS- | M] () – C:\pagefile.sys
[2003/07/07 15:01:33 | 000,007,645 | —- | M] () – C:\pcglicense.txt
[2003/07/21 13:14:51 | 000,000,666 | —- | M] () – C:\remind.log
[2003/03/19 12:51:31 | 000,000,143 | —- | M] () – C:\systemscandata.txt
[2011/01/08 09:32:04 | 000,046,460 | —- | M] () – C:\TDSSKiller.2.4.12.0_08.01.2011_09.28.58_log.txt
[2008/05/04 23:12:05 | 000,000,000 | —- | M] () – C:\uninst.log

< %systemroot%\Fonts\*.com >
[2006/04/18 14:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 13:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 14:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 13:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont
[7 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2003/04/26 00:34:17 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini
[7 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2006/01/18 23:33:38 | 000,078,336 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\LXCZPP5C.DLL
[2008/07/06 05:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2005/10/05 14:57:26 | 000,000,121 | —- | M] () – C:\Program Files\ppunistall.bat

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2003/04/25 17:27:10 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2003/04/25 17:27:10 | 000,602,112 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2003/04/25 17:27:10 | 000,385,024 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2005/10/18 23:11:49 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2008/03/02 08:18:12 | 000,000,198 | -HS- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2008/03/14 14:50:23 | 000,000,077 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2009/03/18 22:14:34 | 000,547,496 | —- | M] (Google Inc.) – C:\Documents and Settings\Owner\Desktop\ChromeSetup.exe
[2008/10/16 23:03:34 | 015,452,536 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Owner\Desktop\IE7-WindowsXP-x86-enu.exe
[2011/01/07 22:14:51 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2010/12/16 09:47:52 | 001,345,624 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\TDSSKiller.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >
[2004/08/11 12:01:36 | 000,013,046 | —- | M] () – C:\WINDOWS\sndo763.src
[7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >
[2005/04/29 15:47:23 | 000,000,905 | —- | M] () – C:\WINDOWS\java\javalog.txt

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >
[1 C:\Program Files\Internet Explorer\*.tmp files -> C:\Program Files\Internet Explorer\*.tmp -> ]

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >
[2007/12/29 17:32:45 | 000,950,784 | —- | M] () – C:\Documents and Settings\Owner\My Documents\1964_084.exe
[2011/01/02 16:55:35 | 004,622,344 | —- | M] (AVG Technologies) – C:\Documents and Settings\Owner\My Documents\avg_free_stb_all_2011_1191_cnet.exe
[2008/09/07 15:00:52 | 000,486,152 | —- | M] (Google Inc.) – C:\Documents and Settings\Owner\My Documents\ChromeSetup.exe
[2007/08/03 18:01:42 | 001,486,720 | —- | M] (Microsoft Corporation) – C:\Documents and Settings\Owner\My Documents\GenuineCheck.exe
[2007/08/03 23:19:10 | 001,164,456 | —- | M] (Adobe Systems Incorporated) – C:\Documents and Settings\Owner\My Documents\install_flash_player.exe
[2005/01/28 01:25:02 | 000,032,768 | —- | M] (UltraMedia) – C:\Documents and Settings\Owner\My Documents\IPStealer.exe
[2008/09/04 23:02:56 | 001,531,392 | —- | M] (Topala Software Solutions) – C:\Documents and Settings\Owner\My Documents\siw.exe

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2002/08/29 07:00:00 | 000,000,791 | —- | M] () – C:\WINDOWS\addins\fxsext.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2008/06/22 13:39:09 | 000,000,140 | -HS- | M] () – C:\Documents and Settings\Owner\Favorites\Desktop.ini
[2005/10/24 14:40:14 | 000,001,527 | —- | M] () – C:\Documents and Settings\Owner\Favorites\Free AOL & Unlimited Internet.lnk

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/01/08 09:33:56 | 000,344,064 | —- | M] () – C:\Documents and Settings\Owner\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-01-02 22:57:17

< End of report >

Extras.txt
—————
OTL Extras logfile created on: 1/8/2011 9:36:16 AM - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,015.00 Mb Total Physical Memory | 705.00 Mb Available Physical Memory | 69.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 33.35 Gb Total Space | 2.89 Gb Free Space | 8.67% Space Free | Partition Type: NTFS
Drive D: | 3.90 Gb Total Space | 1.28 Gb Free Space | 32.72% Space Free | Partition Type: FAT32
Drive F: | 465.68 Gb Total Space | 446.06 Gb Free Space | 95.79% Space Free | Partition Type: FAT32
Drive G: | 111.76 Gb Total Space | 20.50 Gb Free Space | 18.34% Space Free | Partition Type: FAT32

Computer Name: YOUR-B79WZ4ROSE | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = Opera.HTML] – C:\Program Files\Opera\Opera.exe (Opera Software)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
http [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"20243:TCP" = 20243:TCP:*:Enabled:BitComet 20243 TCP
"20243:UDP" = 20243:UDP:*:Enabled:BitComet 20243 UDP
"10575:TCP" = 10575:TCP:*:Enabled:BitComet 10575 TCP
"10575:UDP" = 10575:UDP:*:Enabled:BitComet 10575 UDP
"65123:TCP" = 65123:TCP:*:Enabled:BitComet 65123 TCP
"65123:UDP" = 65123:UDP:*:Enabled:BitComet 65123 UDP
"62100:TCP" = 62100:TCP:*:Enabled:BitComet 62100 TCP
"62100:UDP" = 62100:UDP:*:Enabled:BitComet 62100 UDP
"49344:TCP" = 49344:TCP:*:Enabled:BitComet 49344 TCP
"49344:UDP" = 49344:UDP:*:Enabled:BitComet 49344 UDP
"62341:TCP" = 62341:TCP:*:Enabled:BitComet 62341 TCP
"62341:UDP" = 62341:UDP:*:Enabled:BitComet 62341 UDP
"62444:TCP" = 62444:TCP:*:Enabled:BitComet 62444 TCP
"62444:UDP" = 62444:UDP:*:Enabled:BitComet 62444 UDP
"62333:TCP" = 62333:TCP:*:Enabled:BitComet 62333 TCP
"62333:UDP" = 62333:UDP:*:Enabled:BitComet 62333 UDP
"62334:TCP" = 62334:TCP:*:Enabled:BitComet 62334 TCP
"62334:UDP" = 62334:UDP:*:Enabled:BitComet 62334 UDP
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"6882:TCP" = 6882:TCP:*:Enabled:BitComet 6882 TCP
"6882:UDP" = 6882:UDP:*:Enabled:BitComet 6882 UDP
"23051:TCP" = 23051:TCP:*:Enabled:BitComet 23051 TCP
"23051:UDP" = 23051:UDP:*:Enabled:BitComet 23051 UDP
"67:UDP" = 67:UDP:*:Enabled:DHCP Discovery Service
"13743:TCP" = 13743:TCP:*:Enabled:BitComet 13743 TCP
"13743:UDP" = 13743:UDP:*:Enabled:BitComet 13743 UDP
"49800:TCP" = 49800:TCP:*:Enabled:BitComet 49800 TCP
"49800:UDP" = 49800:UDP:*:Enabled:BitComet 49800 UDP
"49815:TCP" = 49815:TCP:*:Enabled:BitComet 49815 TCP
"49815:UDP" = 49815:UDP:*:Enabled:BitComet 49815 UDP
"23144:TCP" = 23144:TCP:*:Enabled:BitComet 23144 TCP
"23144:UDP" = 23144:UDP:*:Enabled:BitComet 23144 UDP
"63000:TCP" = 63000:TCP:*:Enabled:BitComet 63000 TCP
"63000:UDP" = 63000:UDP:*:Enabled:BitComet 63000 UDP

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"F:\BitComet\BitComet.exe" = F:\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client – File not found
"C:\Documents and Settings\Owner\Desktop\Tim\quake\Quake3\eye\eye.exe" = C:\Documents and Settings\Owner\Desktop\Tim\quake\Quake3\eye\eye.exe:*:Enabled:The All-Seeing Eye – (UDP Soft)
"C:\Documents and Settings\Owner\Desktop\Tim\quake\Quake3\quake3.exe" = C:\Documents and Settings\Owner\Desktop\Tim\quake\Quake3\quake3.exe:*:Enabled:quake3 – ()
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader – (AOL LLC)
"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AOL Instant Messenger – (America Online, Inc.)
"C:\Program Files\mIRC\mirc.exe" = C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC – (mIRC Co. Ltd.)
"C:\Documents and Settings\Owner\My Documents\IPStealer.exe" = C:\Documents and Settings\Owner\My Documents\IPStealer.exe:*:Enabled:IPStealer – (UltraMedia)
"F:\BitComet\Downloads\game1\game\s3.exe" = F:\BitComet\Downloads\game1\game\s3.exe:*:Enabled:Siedler3 – File not found
"C:\ijji\ENGLISH\u_gbound.exe" = C:\ijji\ENGLISH\u_gbound.exe:*:Enabled: – File not found
"F:\gunbound\Gunbound Revolution\GunBound.gme" = F:\gunbound\Gunbound Revolution\GunBound.gme:*:Enabled:GunBound – File not found
"C:\Program Files\BitLord\BitLord.exe" = C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord – (www.BitLord.com)
"F:\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe" = F:\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe:*:Enabled:SiSoftware Database Agent Service – File not found
"F:\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe" = F:\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe:*:Enabled:SiSoftware Sandra Agent Service – File not found
"C:\Program Files\Yahoo!\Messenger\YPager.exe" = C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger – ()
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM – File not found
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\Program Files\AIM7\aim.exe" = C:\Program Files\AIM7\aim.exe:*:Enabled:AIM – (AOL LLC)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser – (Opera Software)
"C:\BitComet\BitComet.exe" = C:\BitComet\BitComet.exe:*:Enabled:BitComet.exe – (www.BitComet.com)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01F9D88C-3C86-4E82-840A-101A3221F67A}" = Microsoft Money 2003
"{02B42D23-10F2-4862-ADA4-3DF1EA0021B2}" = Microsoft Money 2003 System Pack
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0AD84416-63A4-4CF3-BDDF-8FA866711FB0}" = Civilization III
"{13333239-0A15-4855-BEEB-0232DAA5B7EA}" = BlackBerry Desktop Software 5.0.1
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{19ABFD8F-CB86-4965-9282-047FC27084F1}" = SQLXML 3.0 SP3
"{1DCC7418-2089-4BDD-B321-3771956160FC}" = ijji Auto Installer
"{1EE88B84-7BE5-4FB5-8DEA-B81D5409D62E}" = Opera 11.00
"{1FD0C5C1-B01B-4B4C-9607-E5D3B3D1318F}" = Microsoft IntelliPoint 4.1
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java™ 6 Update 14
"{27FAE34E-3285-4953-A1FE-62AE4CE32E12}" = Speed Meter Pro
"{2E1DE390-879C-4291-9B68-DA032D2CC98E}" = AudioEdit Deluxe
"{3248F0A8-6813-11D6-A77B-00B0D0150050}" = J2SE Runtime Environment 5.0 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{43DCF766-6838-4F9A-8C91-D92DA586DFA8}" = Microsoft Windows Journal Viewer
"{45AEEA61-04F8-11D6-8B35-0080C8F5C4AA}" = Veo Digital Studio
"{45E7C481-3EF4-4FCB-AF0B-19F70D618F0C}" = Worms 4 Mayhem
"{4B719A70-F14A-4f5c-90B5-346B24B7FFF1}" = Windows 7 Upgrade Advisor
"{4C2BF3B9-7E8A-49DE-B662-3656FE60BB01}" = Civ3 Conquests v1.22 Full
"{4EF69D40-4DC9-485E-95D3-B1C22F218FC8}" = upapp
"{5888428E-699C-4E71-BF71-94EE06B497DA}" = TuneUp Utilities 2008
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6166700C-2E8C-4BED-B895-B8A954C88C48}" =
"{62369F2F77534556AEF4C58152E3BDE5}" =
"{689E0AB3-50B2-4E5A-9DCE-6DA9F5BE1314}" = BlackBerry® Media Sync
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B76F16C-850D-4E53-B395-8C0690BA9018}" = BlackBerry Device Software v6.0.0 for the BlackBerry 9700 smartphone
"{7459856B-033D-436D-AF96-CE376E601063}" = Any media To XBOX
"{764D06D8-D8DE-411E-A1C8-D9E9380F8A84}" = Microsoft Works 7.0
"{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo Client
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Extreme Graphics Driver
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8EF1122E-E90C-4EE9-AB0C-7FDE2BA42C26}" = Musicmatch® Jukebox
"{90AF0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office PowerPoint Viewer 2003
"{95120000-003F-0409-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{98D451C4-4ACA-4273-BB47-57CFE46B048E}" = WD SmartWare
"{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}" = iTunes
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{ABEB838C-A1A7-4C5D-B7E1-8B4314600816}" = MSN Messenger 7.0
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.1
"{AD88E6DF-A288-4E09-A59B-68E94373BAC7}" = Veo Stingray
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B43357AA-3A6D-4D94-B56E-43C44D09E548}" = Microsoft .NET Framework (English)
"{B5E66589-11D4-4DE5-90F3-1AD5E98ABD3E}" = Civilization III - Play the World v1.27F
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C3113E55-7BCB-4de3-8EBF-60E6CE6B2096}_is1" = SiSoftware Sandra Lite XII.SP1
"{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}" = Apple Mobile Device Support
"{C34FAEF3-4241-4C4E-9CFF-7BBD8BCEABE7}" = WebEx Support Manager for Internet Explorer
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{C59CF2CE-B302-4833-AA35-E0E07D8EBC52}_is1" = SRWare Iron 8.0.555.0
"{C6AA3FB7-804F-4808-AD91-B62D6ED9B788}" = Windows Vista Upgrade Advisor
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{C9416263-0E35-41C9-91C0-32100F0D3448}" = BlackBerry v4.2.1 for the 8100 Series Wireless Handheld
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D271DAE0-8D68-4C97-8356-A126D48A1D8C}" = Ulead Photo Explorer 8.0 SE Basic
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{DFC6573E-124D-4026-BFA4-B433C9D3FF21}" = ISO Recorder
"{E0F252A6-DE85-4E93-A93B-DFC3537B3965}" = WG111v2 Configuration Utility
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E8650C8D-CCB2-496E-816C-ECC54A7EE411}" = Civilization III Play the World
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{EFCE5837-FC21-11D6-9D24-00010240CE95}" = Java 2 Runtime Environment, SE v1.4.1_02
"{F31BC49F-AB7B-4A53-A399-EB7331B585BC}" = Civilization III: Conquests
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F61F2821-694C-475F-99AB-6AF2EFDF40FD}" = Quicken 2003 New User Edition
"{FBDBC490-089D-4476-BF72-1F7A6368200A}" = Pure Networks Platform
"ABBYY FineReader 5.0 Sprint" =
"Ad-Aware" = Ad-Aware
"AddressBook" =
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"Aim Plugin for QQ Games" = Aim Plugin for QQ Games
"AIM_7" = AIM 7
"AIMToolbar" =
"Alarm_is1" = Alarm
"AOL Instant Messenger" = AOL Instant Messenger
"AOLOCP_Y" =
"Audacity_is1" = Audacity 1.2.6
"BackWeb-1940576 Uninstaller" = Compaq Connections
"BitComet" = BitComet 1.24
"BitComet Acceleration Patch_is1" = BitComet Acceleration Patch 3.1
"BitLord" = BitLord 1.1
"BlackBerry_{13333239-0A15-4855-BEEB-0232DAA5B7EA}" = BlackBerry Desktop Software 5.0.1
"COMODO Firewall Pro" = COMODO Firewall Pro
"Connection Manager" =
"Data Access Objects (DAO) 3.5" = Data Access Objects (DAO) 3.5
"D-Fend v2" = D-Fend v2
"Diablo II" = Diablo II
"DirectAnimation" =
"DirectDrawEx" =
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DriverAgent" = DriverAgent Plugin for Netscape by TouchStone Software
"DXM_Runtime" =
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 6.5.2 Home Edition
"Fallout Tactics" = Fallout Tactics
"filehippo.com" = filehippo.com Update Checker
"Fontcore" =
"Half-Life" = Half-Life
"hp instant support" = hp instant support
"ICW" =
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"IE40" =
"IE4Data" =
"IE5BAKEX" =
"ie8" = Windows Internet Explorer 8
"IEData" =
"Im6um" = IMBUM
"InstallShield Uninstall Information" =
"InstallShield_{2A267BC6-F77F-4DD4-825F-7AEB1F68B4B1}" =
"InstallShield_{E0F252A6-DE85-4E93-A93B-DFC3537B3965}" = NETGEAR WG111v2 wireless USB 2.0 adapter
"InstallShield_{F61F2821-694C-475F-99AB-6AF2EFDF40FD}" = Quicken 2003 New User Edition
"Instant Support" = Instant Support
"IsoBuster_is1" = IsoBuster 1.4
"Java Web Start" = Java Web Start
"Lexmark 1200 Series" = Lexmark 1200 Series
"LiveReg" = LiveReg (Symantec Corporation)
"LiveUpdate" = LiveUpdate 1.80 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework Full v1.0.3705 (1033)" = Microsoft .NET Framework (English) v1.0.3705
"Microsoft Interactive Training" =
"Microsoft Internet Gaming Zone" = MSN Gaming Zone
"Microsoft NetShow Player 2.0" =
"mIRC" = mIRC
"MobileOptionPack" =
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSI30a-KB884016" =
"MSI30-Beta1" =
"MSI30-Beta2" =
"MSI30-KB884016" =
"MSI30-RC1" =
"MSI30-RC2" =
"MSI31-Beta" =
"MSI31-RC1" =
"MsJavaVM" =
"MSN Music Assistant" = MSN Music Assistant
"MSN Toolbar" = MSN Toolbar
"NetMeeting" =
"Network Play System (Patching)" = Network Play System (Patching)
"NikSaver_is1" = NikSaver 1.6
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"OutlookExpress" =
"PC Pitstop Optimize_is1" = PC Pitstop Optimize 1.5
"PCHealth" =
"PowerISO" = PowerISO
"PS2" = PS2
"qt7lite_is1" = QT Lite 2.2.0
"Quake III Arena Point Release 1.32" = Quake III Arena Point Release 1.32
"QuickTime32" = QuickTime for Windows (32-bit)
"Radio@Netscape Plus" = Radio@Netscape Plus
"RealPlayer 6.0" = RealPlayer
"S3Display" = S3Display
"S3Gamma2" = S3Gamma2
"S3Info2" = S3Info2
"S3Overlay" = S3Overlay
"sandra_std_un" = SiSoft Sandra 99 Standard
"SchedulingAgent" =
"Shockwave" = Shockwave
"Simple Port Forwarding" = Simple Port Forwarding
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"Speed Meter ProUninstall" = Speed Meter Pro
"ST4UNST #1" = Name Maker Studio G2 v4.26
"Starcraft" = Starcraft
"System Requirements Lab" = System Requirements Lab
"Trend Micro HouseCall 6.6" = HouseCall 6.6
"UHS Reader (Version 5.10)" = UHS Reader (Version 5.10)
"UltraDefrag" = Ultra Defragmenter
"Videora Xbox 360 Converter" = Videora Xbox 360 Converter 4.04
"Viewpoint Manager" = Viewpoint Manager (Remove Only)
"ViewpointMediaPlayer" = Viewpoint Media Player
"WIC" = Windows Imaging Component
"WildTangent CDA" = WildTangent Web Driver
"Winamp" = Winamp (remove only)
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR archiver
"WinUpdatesList" = WinUpdatesList
"WinZip" = WinZip
"WMCSetup" =
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Yahoo! Companion" = Yahoo! Companion
"Yahoo! Messenger" = Yahoo! Messenger
"zMUD" = zMUD 7.21.0.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Diablo II" = Diablo II
"ijji FireFox Launcher" = ijji FireFox Launcher 1.0
"MiraScan" = MiraScan V3.04

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/25/2010 11:23:17 AM | Computer Name = YOUR-B79WZ4ROSE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 6/25/2010 11:23:23 AM | Computer Name = YOUR-B79WZ4ROSE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 6/25/2010 11:23:29 AM | Computer Name = YOUR-B79WZ4ROSE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 6/25/2010 11:24:01 AM | Computer Name = YOUR-B79WZ4ROSE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The operation timed out

Error - 6/25/2010 11:24:34 AM | Computer Name = YOUR-B79WZ4ROSE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

Error - 6/25/2010 11:24:43 AM | Computer Name = YOUR-B79WZ4ROSE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 6/27/2010 7:13:43 PM | Computer Name = YOUR-B79WZ4ROSE | Source = Application Error | ID = 1000
Description = Faulting application plugin-container.exe, version 1.9.2.3814, faulting
module ntdll.dll, version 5.1.2600.3520, fault address 0x0000100b.

Error - 6/28/2010 4:35:34 PM | Computer Name = YOUR-B79WZ4ROSE | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 6/28/2010 4:35:34 PM | Computer Name = YOUR-B79WZ4ROSE | Source = crypt32 | ID = 131083
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file.

Error - 6/28/2010 4:35:49 PM | Computer Name = YOUR-B79WZ4ROSE | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This operation returned because the timeout period expired.

[ System Events ]
Error - 1/7/2011 11:17:43 PM | Computer Name = YOUR-B79WZ4ROSE | Source = Ftdisk | ID = 262189
Description = The system could not sucessfully load the crash dump driver.

Error - 1/7/2011 11:17:43 PM | Computer Name = YOUR-B79WZ4ROSE | Source = Ftdisk | ID = 262193
Description = Configuring the Page file for crash dump failed. Make sure there is
a page file on the boot partition and that is large enough to contain all physical
memory.

Error - 1/7/2011 11:17:55 PM | Computer Name = YOUR-B79WZ4ROSE | Source = Service Control Manager | ID = 7001
Description = The Print Spooler service depends on the LexBce Server service which
failed to start because of the following error: %%1058

Error - 1/7/2011 11:17:55 PM | Computer Name = YOUR-B79WZ4ROSE | Source = Service Control Manager | ID = 7000
Description = The mrtRate service failed to start due to the following error: %%2

Error - 1/7/2011 11:17:55 PM | Computer Name = YOUR-B79WZ4ROSE | Source = Service Control Manager | ID = 7000
Description = The Upload Manager service failed to start due to the following error:
%%1079

Error - 1/8/2011 10:34:03 AM | Computer Name = YOUR-B79WZ4ROSE | Source = sr | ID = 1
Description = The System Restore filter encountered the unexpected error '0xC0000001'
while processing the file '' on the volume 'HarddiskVolume2'. It has stopped monitoring
the volume.

Error - 1/8/2011 10:34:25 AM | Computer Name = YOUR-B79WZ4ROSE | Source = Service Control Manager | ID = 7001
Description = The Print Spooler service depends on the LexBce Server service which
failed to start because of the following error: %%1058

Error - 1/8/2011 10:34:25 AM | Computer Name = YOUR-B79WZ4ROSE | Source = Service Control Manager | ID = 7000
Description = The mrtRate service failed to start due to the following error: %%2

Error - 1/8/2011 10:34:25 AM | Computer Name = YOUR-B79WZ4ROSE | Source = Service Control Manager | ID = 7000
Description = The Upload Manager service failed to start due to the following error:
%%1079

Error - 1/8/2011 10:34:29 AM | Computer Name = YOUR-B79WZ4ROSE | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
viaagp1

< End of report >

mowman

Post #4January 9, 2011, 12:51 AM UTC

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services

:Otl
O3 - HKLM\..\Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {40D41A8B-D79B-43D7-99A7-9EE0F344C385} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {B195B3B3-8A05-11D3-97A4-0004ACA6948E} - No CLSID value found.
O20 - Winlogon\Notify\dimsntfy: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\khfffdb: DllName - khfffdb.dll - File not found
O33 - MountPoints2\{16417dcc-6f59-11df-818d-00402b634c86}\Shell - "" = AutoRun
O33 - MountPoints2\{16417dcc-6f59-11df-818d-00402b634c86}\Shell\Auto\command - "" = F:\Server.exe – File not found
O33 - MountPoints2\{16417dcc-6f59-11df-818d-00402b634c86}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3dfaf873-5083-11de-8147-00d041af2cb3}\Shell\AutoRun\command - "" = F:\RECYCLER\k-1-3542-4232123213-7676767-8888886\hn.exe – File not found
O33 - MountPoints2\{3dfaf873-5083-11de-8147-00d041af2cb3}\Shell\open\command - "" = F:\RECYCLER\k-1-3542-4232123213-7676767-8888886\hn.exe – File not found
O33 - MountPoints2\{6bc16841-6856-11db-8057-000fb5d8bcd0}\Shell\AutoRun\command - "" = G:\JDSecure\Windows\JDSecure31.exe – File not found
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\Info.exe – [2002/09/10 21:54:58 | 000,040,960 | -HS- | M] (XSS)
[2008/05/31 19:12:11 | 002,144,487 | —- | C] () – C:\WINDOWS\_005551_.tmp.dll
[2008/05/31 19:12:02 | 000,010,027 | —- | C] () – C:\WINDOWS\_005552_.tmp.dll
[2008/05/31 19:11:55 | 000,026,991 | —- | C] () – C:\WINDOWS\_005554_.tmp.dll
[2008/05/31 19:11:55 | 000,012,363 | —- | C] () – C:\WINDOWS\_005555_.tmp.dll
[2001/01/01 20:40:20 | 000,249,270 | —- | C] () – C:\WINDOWS\System32\_006024_.tmp.dll
[2001/01/01 20:20:44 | 000,022,040 | —- | C] () – C:\WINDOWS\System32\_005992_.tmp.dll
[2008/05/31 19:11:17 | 000,402,264 | —- | C] () – C:\WINDOWS\_005560_.tmp.dll


:Commands
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log ( don't check the boxes beside LOP Check or Purity this time )

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Next

Run the following scan: Eset Online Scanner

Place a check mark in the box YES, I accept the Terms Of Use
Click the Start button.
Now click the Install button.
Click Start. The scanner engine will initialize and update.
Place a check mark in the box beside Remove found threats.
Click the Scan button. The scan will now run, please be patient.
When the scan finishes click the Details tab.
Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.

Timo529

Post #5January 9, 2011, 5:56 AM UTC

New OTL Log
———————-
OTL logfile created on: 1/9/2011 12:21:54 AM - Run 2
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,015.00 Mb Total Physical Memory | 635.00 Mb Available Physical Memory | 63.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 90.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 33.35 Gb Total Space | 3.67 Gb Free Space | 11.00% Space Free | Partition Type: NTFS
Drive D: | 3.90 Gb Total Space | 1.28 Gb Free Space | 32.72% Space Free | Partition Type: FAT32
Drive G: | 111.76 Gb Total Space | 20.50 Gb Free Space | 18.35% Space Free | Partition Type: FAT32

Computer Name: YOUR-B79WZ4ROSE | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\COMODO\Firewall\cmdagent.exe ()
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
PRC - C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\Runservice.exe ()

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\guard32.dll ()
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (SandraTheSrv) – F:\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe File not found
SRV - (SandraDataSrv) – F:\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe File not found
SRV - (Imapi Helper) – F:\isoburener\ImapiHelper.exe File not found
SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (WDFME) – C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe ()
SRV - (WDSC) – C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe ()
SRV - (WDDMService) – C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC)
SRV - (cmdAgent) – C:\Program Files\COMODO\Firewall\cmdagent.exe ()
SRV - (nmservice) – C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
SRV - (TuneUp.Defrag) – C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software GmbH)
SRV - (UxTuneUp) – C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (LicCtrlService) – C:\WINDOWS\Runservice.exe ()
SRV - (GEARSecurity) – C:\WINDOWS\system32\gearsec.exe (GEAR Software)

========== Driver Services (SafeList) ==========

DRV - (dump_wmimmc) – F:\gunbound\Gunbound Revolution\GameGuard\dump_wmimmc.sys File not found
DRV - (epmntdrv) – C:\WINDOWS\system32\epmntdrv.sys ()
DRV - (EuGdiDrv) – C:\WINDOWS\system32\EuGdiDrv.sys ()
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (Inspect) – C:\WINDOWS\System32\DRIVERS\inspect.sys (COMODO)
DRV - (cmdGuard) – C:\WINDOWS\system32\drivers\cmdguard.sys (COMODO)
DRV - (cmdHlp) – C:\WINDOWS\system32\drivers\cmdhlp.sys (COMODO)
DRV - (WDC_SAM) – C:\WINDOWS\system32\drivers\wdcsam.sys (Western Digital Technologies)
DRV - (pnpcap) – C:\WINDOWS\system32\drivers\pnpcap.sys (Cisco Systems, Inc.)
DRV - (purendis) – C:\WINDOWS\system32\drivers\purendis.sys (Cisco Systems, Inc.)
DRV - (pnarp) – C:\WINDOWS\system32\drivers\pnarp.sys (Cisco Systems, Inc.)
DRV - (MxlW2k) – C:\WINDOWS\System32\drivers\MxlW2k.sys (MusicMatch, Inc.)
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (SCDEmu) – C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (ultradfg) – C:\WINDOWS\system32\drivers\ultradfg.sys (DASoft Development Team)
DRV - (RTLWUSB) – C:\WINDOWS\system32\drivers\wg111v2.sys (NETGEAR Inc.)
DRV - (tmcomm) – C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (RT73) – C:\WINDOWS\system32\drivers\rt73.sys (Ralink Technology, Corp.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\rtl8139.sys (Realtek Semiconductor Corporation)
DRV - (S3Psddr) – C:\WINDOWS\system32\drivers\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (SNDO763) – C:\WINDOWS\system32\drivers\sndo763.sys ()
DRV - (ALCXSENS) – C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura Ltd)
DRV - (NPPTNT) – C:\WINDOWS\system32\npptNT.sys (INCA Internet Co., Ltd.)
DRV - (ltmodem5) – C:\WINDOWS\system32\drivers\ltmdmnt.sys (LT)
DRV - (viaagp1) – C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (SjyPkt) – C:\WINDOWS\system32\drivers\SjyPkt.sys (Windows ® 2000 DDK provider)
DRV - (Ps2) – C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)
DRV - (DCamUSBVeo532) – C:\WINDOWS\system32\drivers\ubVeo532.sys (IC Media Corporation)
DRV - (IPFilter) – C:\WINDOWS\system32\drivers\ipfilter.sys (Microsoft Corporation)
DRV - (irsir) – C:\WINDOWS\system32\drivers\irsir.sys (Microsoft Corporation)
DRV - (DTC328X) – C:\WINDOWS\System32\drivers\DTC328X.SYS (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Data = C3 17 11 E0 B2 A4 AC 29 3E F1 D7 B3 41 B1 26 5E 77 7F FB 0D C7 48 7E BE 12 BE E1 AD BE 28 [binary data]
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:1.10
FF - prefs.js..extensions.enabledItems: [removed]:0.20
FF - prefs.js..extensions.enabledItems: {567F62D2-2162-43fe-A573-E5620D0934B2}:1.6
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.08
FF - prefs.js..extensions.enabledItems: {F5CEF9AD-F6AF-4b69-AB6D-936BF6BCB6D7}:1.5
FF - prefs.js..network.proxy.type: 4

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealOne Player\browserrecord [2008/05/17 03:31:46 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/11 16:25:34 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/10 18:47:59 | 000,000,000 | —D | M]

[2008/06/20 19:15:11 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2011/01/08 19:42:24 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\pbf9imzw.default\extensions
[2010/04/27 19:04:03 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\pbf9imzw.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2008/03/09 13:27:08 | 000,000,000 | —D | M] (MidnightFox) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\pbf9imzw.default\extensions\{66871bd1-5ba2-4739-b485-2a15f5969bd8}(2)
[2011/01/08 19:42:24 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) – C:\PROGRAM FILES\COMETBIRD\EXTENSIONS\{567F62D2-2162-43FE-A573-E5620D0934B2}
File not found (No name found) – C:\PROGRAM FILES\COMETBIRD\EXTENSIONS\{B042753D-F57E-4E8E-A01B-7379A6D4CEFB}
File not found (No name found) – C:\PROGRAM FILES\COMETBIRD\EXTENSIONS\{F5CEF9AD-F6AF-4B69-AB6D-936BF6BCB6D7}
File not found (No name found) – C:\PROGRAM FILES\COMETBIRD\EXTENSIONS\[removed]
File not found (No name found) – C:\PROGRAM FILES\COMETBIRD\EXTENSIONS\[removed]
[2010/08/24 04:31:30 | 000,773,120 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2007/07/25 03:51:06 | 000,164,352 | —- | M] (Indiepath Ltd) – C:\Program Files\Mozilla Firefox\plugins\npigl.dll
[2009/05/20 00:49:50 | 000,083,376 | —- | M] (NHN USA Inc.) – C:\Program Files\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll
[2009/05/27 15:41:50 | 000,069,632 | —- | M] (NHN USA Inc. ) – C:\Program Files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
[2007/04/16 12:07:12 | 000,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

Hosts file not found
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Player\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\BitComet\tools\BitCometBHO_1.4.11.9.dll (BitComet)
O2 - BHO: (ST) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll (Microsoft Corporation)
O2 - BHO: (MSNToolBandBHO) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (Microsoft Corporation)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (MSN) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (&Yahoo;! Companion) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (MSN) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Yahoo;! Companion) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll (Yahoo! Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &D;&ownload; &with; BitComet - G:\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D;&ownload; all video with BitComet - G:\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &D;&ownload; all with BitComet - G:\BitComet\BitComet.exe (www.BitComet.com)
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe File not found
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe File not found
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\BitComet\tools\BitCometBHO_1.4.11.9.dll (BitComet)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\NewDotNet\newdotnet6_38.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll File not found
O15 - HKCU\..Trusted Ranges: Range1979 ([http] in Trusted sites)
O16 - DPF: {00000075-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/voxacm.CAB (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab (Yahoo! Audio Conferencing)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} http://download.yahoo.com/dl/installs/yinst0401.cab (YInstStarter Class)
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} http://chat.yahoo.com/cab/yacsui.cab (Yahoo! Audio UI1)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/…7811.3900810185 (Reg Error: Key error.)
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll (Reg Error: Key error.)
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} http://www.crucial.com/controls/cpcScanner.cab (Crucial cpcScan)
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} http://fdl.msn.com/zone/datafiles/heartbeat.cab (HeartbeatCtl Class)
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} http://www.srtest.com/sysreqlab.cab (System Requirements Lab Class)
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} http://java.sun.com/products/plugin/1.4/ji…indows-i586.cab (Java Plug-in 1.4.1_02)
O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://l.yimg.com/jh/games/web_games/popca…aploader_v6.cab (Reg Error: Key error.)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: JT's Blocks http://download.games.yahoo.com/games/clients/y/blt1_x.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: Yahoo! Chat http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab (Reg Error: Key error.)
O16 - DPF: Yahoo! Poker http://download.games.yahoo.com/games/clients/y/pt0_x.cab (Reg Error: Key error.)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (RtlGina2.dll) - C:\WINDOWS\System32\RtlGina2.dll ()
O20 - HKLM Winlogon: UIHost - (C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe) - C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O29 - HKLM SecurityProviders - (zwebauth.dll) - C:\WINDOWS\System32\ZWebAuth.dll ()
O29 - HKLM SecurityProviders - (zpasspc.dll) - C:\WINDOWS\System32\zpasspc.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/02/26 14:49:14 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 06:07:38 | 000,000,000 | RHS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O32 - AutoRun File - [2002/09/11 03:02:32 | 000,000,045 | -HS- | M] () - D:\Autorun.inf – [ FAT32 ]
O32 - AutoRun File - [2002/10/17 09:56:50 | 000,000,036 | RH– | M] () - G:\autorun.inf – [ FAT32 ]
O32 - AutoRun File - [2002/10/28 13:03:12 | 000,000,000 | RH-D | M] - G:\autorun – [ FAT32 ]
O32 - AutoRun File - [2005/09/20 16:15:32 | 000,009,473 | —- | M] () - G:\Autoexec1.cfg – [ FAT32 ]
O32 - AutoRun File - [2005/10/07 20:20:10 | 000,009,813 | —- | M] () - G:\Autoexec.cfg – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/01/09 00:05:55 | 000,000,000 | —D | C] – C:\_OTL
[2011/01/08 09:28:55 | 001,345,624 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\TDSSKiller.exe
[2011/01/07 22:14:56 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/01/06 00:04:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\SRWare Iron
[2011/01/06 00:04:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Chromium
[2011/01/06 00:04:35 | 000,000,000 | —D | C] – C:\Program Files\SRWare Iron
[2011/01/05 01:45:56 | 000,061,440 | —- | C] (Windswept Software) – C:\WINDOWS\System32\digitbox.ocx
[2011/01/05 01:45:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Alarm
[2011/01/05 01:45:55 | 000,000,000 | —D | C] – C:\Program Files\Alarm
[2011/01/02 23:02:01 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2011/01/02 22:52:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Temp
[2011/01/02 17:51:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Start Menu\Programs\Simple Port Forwarding
[2011/01/02 17:51:19 | 000,000,000 | —D | C] – C:\WINDOWS\Simple Port Forwarding
[2011/01/02 17:51:18 | 000,000,000 | —D | C] – C:\Program Files\Simple Port Forwarding
[2011/01/02 17:37:20 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2011/01/02 17:06:27 | 000,000,000 | —D | C] – C:\Program Files\Google
[2011/01/02 17:06:19 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
[2011/01/02 17:05:29 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Lavasoft
[2011/01/02 17:05:28 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2011/01/02 16:55:43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/01/02 16:55:33 | 004,622,344 | —- | C] (AVG Technologies) – C:\Documents and Settings\Owner\My Documents\avg_free_stb_all_2011_1191_cnet.exe
[2011/01/02 14:10:34 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Malwarebytes
[2011/01/02 14:10:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/01/02 14:10:04 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/01/02 14:10:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/01/02 14:09:52 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/01/02 14:09:51 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/12/21 23:14:56 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\FKRMonitor
[2010/12/21 23:14:52 | 000,000,000 | —D | C] – C:\Program Files\FKRMonitor
[2004/12/25 10:18:20 | 000,036,864 | —- | C] ( ) – C:\WINDOWS\System32\vsndo763.dll
[7 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]
[3 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/01/09 00:19:40 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/01/09 00:19:39 | 000,000,801 | -HS- | M] () – C:\WINDOWS\System32\mmf.sys
[2011/01/09 00:19:34 | 000,000,486 | —- | M] () – C:\WINDOWS\tasks\1-Click Maintenance.job
[2011/01/09 00:19:17 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/01/09 00:02:03 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/01/09 00:01:00 | 000,000,234 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/01/08 09:28:24 | 001,232,020 | —- | M] () – C:\Documents and Settings\Owner\Desktop\tdsskiller.zip
[2011/01/08 01:54:13 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/01/07 22:36:58 | 000,359,929 | —- | M] () – C:\Documents and Settings\Owner\Desktop\dds.scr
[2011/01/07 22:15:47 | 000,000,460 | RHS- | M] () – C:\boot.ini
[2011/01/07 22:14:51 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/01/06 00:04:53 | 000,000,687 | —- | M] () – C:\Documents and Settings\All Users\Desktop\SRWare Iron.lnk
[2011/01/05 01:45:56 | 000,000,686 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Alarm.lnk
[2011/01/02 21:44:15 | 000,000,833 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Shortcut to Heroes3.exe.lnk
[2011/01/02 17:51:34 | 000,001,641 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Simple Port Forwarding.lnk
[2011/01/02 17:06:17 | 000,000,893 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2011/01/02 17:06:17 | 000,000,875 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2011/01/02 16:55:35 | 004,622,344 | —- | M] (AVG Technologies) – C:\Documents and Settings\Owner\My Documents\avg_free_stb_all_2011_1191_cnet.exe
[2011/01/02 14:10:07 | 000,000,792 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/01/01 11:11:00 | 000,000,600 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Opera.lnk
[2010/12/20 18:09:00 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/12/16 09:47:52 | 001,345,624 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\TDSSKiller.exe
[2010/12/14 23:48:43 | 000,095,744 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/14 22:02:20 | 000,000,256 | —- | M] () – C:\WINDOWS\System32\pool.bin
[2010/12/14 20:37:30 | 005,165,625 | —- | M] () – C:\Documents and Settings\Owner\My Documents\LoaderBackup-(2010-12-14).ipd
[2010/12/14 20:28:59 | 005,135,070 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Backup-(2010-12-14).ipd
[2010/12/10 18:48:00 | 000,000,478 | —- | M] () – C:\Documents and Settings\Owner\Desktop\danettaclasses.doc
[3 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/01/08 09:28:30 | 001,232,020 | —- | C] () – C:\Documents and Settings\Owner\Desktop\tdsskiller.zip
[2011/01/07 22:37:08 | 000,359,929 | —- | C] () – C:\Documents and Settings\Owner\Desktop\dds.scr
[2011/01/06 00:04:53 | 000,000,687 | —- | C] () – C:\Documents and Settings\All Users\Desktop\SRWare Iron.lnk
[2011/01/05 01:45:56 | 000,000,686 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Alarm.lnk
[2011/01/02 22:57:28 | 000,000,886 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/01/02 21:44:15 | 000,000,833 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Shortcut to Heroes3.exe.lnk
[2011/01/02 17:51:34 | 000,001,641 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Simple Port Forwarding.lnk
[2011/01/02 17:12:09 | 000,000,880 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/01/02 17:06:17 | 000,000,893 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Ad-Aware.lnk
[2011/01/02 17:06:17 | 000,000,875 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2011/01/02 14:10:07 | 000,000,792 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/14 20:37:29 | 005,165,625 | —- | C] () – C:\Documents and Settings\Owner\My Documents\LoaderBackup-(2010-12-14).ipd
[2010/12/14 20:28:59 | 005,135,070 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Backup-(2010-12-14).ipd
[2010/11/26 19:06:03 | 000,014,848 | —- | C] () – C:\WINDOWS\System32\EuEpmGdi.dll
[2010/11/26 19:06:03 | 000,013,192 | —- | C] () – C:\WINDOWS\System32\epmntdrv.sys
[2010/11/26 19:06:03 | 000,008,456 | —- | C] () – C:\WINDOWS\System32\EuGdiDrv.sys
[2010/11/26 17:52:58 | 000,106,264 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/06/04 22:37:33 | 008,673,792 | —- | C] () – C:\Documents and Settings\All Users\Application Data\atscie.msi
[2008/04/16 10:24:14 | 000,716,272 | —- | C] () – C:\WINDOWS\System32\drivers\sptd.sys
[2008/03/31 21:42:39 | 000,155,384 | —- | C] () – C:\WINDOWS\System32\guard32.dll
[2008/03/09 16:02:43 | 000,000,067 | —- | C] () – C:\WINDOWS\AVIConverter.INI
[2008/03/09 06:26:20 | 000,091,648 | —- | C] () – C:\WINDOWS\System32\lua5.1a.dll
[2008/01/12 00:27:59 | 000,001,357 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/12/10 02:03:11 | 000,034,308 | —- | C] () – C:\WINDOWS\System32\BASSMOD.dll
[2007/08/09 13:37:05 | 000,043,520 | —- | C] () – C:\WINDOWS\System32\CmdLineExt03.dll
[2007/08/03 23:37:36 | 000,000,021 | —- | C] () – C:\WINDOWS\atid.ini
[2007/01/15 13:24:28 | 000,000,180 | —- | C] () – C:\WINDOWS\dellstat.ini
[2007/01/15 13:24:25 | 000,000,389 | —- | C] () – C:\WINDOWS\lexstat.ini
[2007/01/15 13:23:35 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxczvs.dll
[2007/01/15 13:22:31 | 000,000,270 | —- | C] () – C:\WINDOWS\System32\lxczcoin.ini
[2006/05/03 17:44:32 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\RtlGina2.dll
[2005/10/05 14:57:26 | 000,000,121 | —- | C] () – C:\Program Files\ppunistall.bat
[2005/02/24 02:00:59 | 000,000,044 | —- | C] () – C:\WINDOWS\liveup.ini
[2005/02/02 02:53:23 | 000,000,784 | —- | C] () – C:\Documents and Settings\Owner\Application Data\mpauth.dat
[2005/01/27 00:33:46 | 000,012,288 | —- | C] () – C:\WINDOWS\impborl.dll
[2005/01/03 01:07:42 | 000,000,026 | —- | C] () – C:\WINDOWS\ulead32.ini
[2004/12/25 11:46:29 | 000,000,071 | —- | C] () – C:\WINDOWS\pex.INI
[2004/12/25 10:18:21 | 000,233,472 | —- | C] () – C:\WINDOWS\System32\sndo763.dll
[2004/12/25 10:18:21 | 000,218,112 | —- | C] () – C:\WINDOWS\System32\drivers\sndo763.sys
[2004/12/25 10:18:21 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\dsndo763.dll
[2004/12/25 10:18:21 | 000,015,522 | —- | C] () – C:\WINDOWS\sndo763.ini
[2004/12/07 01:43:48 | 000,000,056 | RHS- | C] () – C:\WINDOWS\System32\18E2FC8E4C.sys
[2004/05/19 12:09:11 | 000,000,508 | —- | C] () – C:\WINDOWS\SIERRA.INI
[2004/05/09 07:23:37 | 000,000,226 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/03/07 21:23:27 | 000,000,050 | —- | C] () – C:\WINDOWS\System32\MSrev01.dll
[2004/03/07 20:03:36 | 000,000,854 | —- | C] () – C:\WINDOWS\entpack.ini
[2004/02/03 23:56:49 | 000,000,026 | —- | C] () – C:\WINDOWS\System32\MSrev21.dll
[2004/02/03 23:56:45 | 000,000,093 | —- | C] () – C:\WINDOWS\System32\MSrev41.dll
[2004/01/03 17:01:13 | 000,000,633 | —- | C] () – C:\WINDOWS\fantasy2.ini
[2004/01/03 17:01:13 | 000,000,207 | —- | C] () – C:\WINDOWS\videoimp.ini
[2004/01/03 17:01:12 | 000,000,113 | —- | C] () – C:\WINDOWS\photoimpression.ini
[2004/01/03 17:00:54 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2003/12/25 11:38:55 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\Veo532ut.dll
[2003/12/25 11:38:55 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\VeoSetup532.dll
[2003/12/19 15:00:48 | 000,000,801 | -HS- | C] () – C:\WINDOWS\System32\mmf.sys
[2003/12/19 15:00:48 | 000,000,801 | -HS- | C] () – C:\WINDOWS\System32\mmf(2)(2).sys
[2003/12/19 15:00:46 | 000,045,056 | —- | C] () – C:\WINDOWS\mmfs.dll
[2003/12/05 17:15:04 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/12/05 17:14:59 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\devenum(2).dll
[2003/11/23 20:10:30 | 000,000,402 | —- | C] () – C:\WINDOWS\Belt.ini
[2003/11/19 19:06:05 | 000,000,804 | —- | C] () – C:\WINDOWS\System32\ncase.ini
[2003/10/04 14:43:58 | 000,021,840 | —- | C] () – C:\WINDOWS\System32\SIntfNT.dll
[2003/10/04 14:43:58 | 000,017,212 | —- | C] () – C:\WINDOWS\System32\SIntf32.dll
[2003/10/04 14:43:58 | 000,012,067 | —- | C] () – C:\WINDOWS\System32\SIntf16.dll
[2003/08/23 09:59:24 | 000,046,512 | —- | C] () – C:\WINDOWS\System32\EPSN.DLL
[2003/08/23 09:59:24 | 000,011,934 | —- | C] () – C:\WINDOWS\System32\PIXPNR.DLL
[2003/08/23 09:59:23 | 000,012,126 | —- | C] () – C:\WINDOWS\System32\PIXPCZ.DLL
[2003/08/23 09:51:52 | 000,046,592 | —- | C] () – C:\WINDOWS\System32\WNASPI32.DLL
[2003/08/21 13:43:37 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2003/08/07 20:35:11 | 000,016,973 | —- | C] () – C:\WINDOWS\System32\ZWebAuth.dll
[2003/07/11 21:37:22 | 000,008,379 | —- | C] () – C:\WINDOWS\cdPlayer.ini
[2003/07/11 19:57:03 | 000,000,632 | —- | C] () – C:\WINDOWS\Qiii.INI
[2003/07/09 11:36:51 | 000,001,125 | —- | C] () – C:\WINDOWS\winamp.ini
[2003/07/08 22:30:05 | 000,095,744 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2003/07/08 21:49:41 | 000,000,344 | —- | C] () – C:\WINDOWS\QTW.INI
[2003/07/08 17:49:06 | 000,000,088 | —- | C] () – C:\WINDOWS\odbc.ini
[2003/07/07 10:07:55 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\iAlmcoin.dll
[2003/05/30 08:00:02 | 001,246,208 | —- | C] () – C:\WINDOWS\System32\quartz(2).dll
[2003/04/28 22:12:02 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/04/26 02:05:29 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2003/04/26 02:02:53 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\syscontr.dll
[2003/04/26 02:02:52 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2003/04/26 01:34:11 | 000,000,052 | —- | C] () – C:\WINDOWS\intuprof.ini
[2003/04/26 01:34:01 | 000,000,626 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2003/04/26 01:18:01 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2003/04/26 00:53:15 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2003/04/26 00:53:15 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2003/04/26 00:52:58 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2003/04/26 00:37:56 | 000,000,802 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/04/26 00:24:49 | 000,000,552 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/04/25 17:28:36 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2003/03/01 02:47:30 | 000,158,790 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\SVGAbout001.svg
[2002/12/12 09:14:32 | 000,013,312 | —- | C] () – C:\WINDOWS\System32\msdmo(2).dll
[2002/10/03 13:42:27 | 000,000,034 | —- | C] () – C:\WINDOWS\Q3version.ini
[2002/08/20 19:37:50 | 000,093,696 | —- | C] () – C:\WINDOWS\System32\zlib.dll
[2002/04/11 13:47:52 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\msmscoin.dll
[1999/12/02 18:45:46 | 000,046,864 | —- | C] () – C:\WINDOWS\System32\zoneauth.dll

< End of report >

Attempted to update Malwarebytes it would not update got cannot connect to server. Ran the scan anyway found no threats but here is the log file.
————————-
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5363

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

1/9/2011 12:51:08 AM
mbam-log-2011-01-09 (00-51-07).txt

Scan type: Quick scan
Objects scanned: 135551
Time elapsed: 6 minute(s), 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Attempted to run ESAT Online Scanner and it said it could not get update and would not run either.

mowman

Post #6January 9, 2011, 9:47 AM UTC

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See this Link for programs that need to be disabled and instruction on how to disable them.
Remember to re-enable them when we're done.
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Timo529

Post #7January 9, 2011, 2:32 PM UTC

Log File from ComboFix:
————————————-
ComboFix 11-01-08.04 - Owner 01/09/2011 8:37.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.667 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Internet Explorer\SET732.tmp
c:\windows\Downloaded Program Files\popcaploader.dll
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\Fonts\acrsec.fon
c:\windows\Readme.txt
c:\windows\system32\_005981_.tmp.dll
c:\windows\system32\_005982_.tmp.dll
c:\windows\system32\_005983_.tmp.dll
c:\windows\system32\_005984_.tmp.dll
c:\windows\system32\_005989_.tmp.dll
c:\windows\system32\_005990_.tmp.dll
c:\windows\system32\_005991_.tmp.dll
c:\windows\system32\_005993_.tmp.dll
c:\windows\system32\_005994_.tmp.dll
c:\windows\system32\_005995_.tmp.dll
c:\windows\system32\_005996_.tmp.dll
c:\windows\system32\_005997_.tmp.dll
c:\windows\system32\_006000_.tmp.dll
c:\windows\system32\_006001_.tmp.dll
c:\windows\system32\_006003_.tmp.dll
c:\windows\system32\_006004_.tmp.dll
c:\windows\system32\_006005_.tmp.dll
c:\windows\system32\_006007_.tmp.dll
c:\windows\system32\_006009_.tmp.dll
c:\windows\system32\_006010_.tmp.dll
c:\windows\system32\_006011_.tmp.dll
c:\windows\system32\_006012_.tmp.dll
c:\windows\system32\_006014_.tmp.dll
c:\windows\system32\_006015_.tmp.dll
c:\windows\system32\_006016_.tmp.dll
c:\windows\system32\_006017_.tmp.dll
c:\windows\system32\_006018_.tmp.dll
c:\windows\system32\_006021_.tmp.dll
c:\windows\system32\_006022_.tmp.dll
c:\windows\system32\_006023_.tmp.dll
c:\windows\system32\_006025_.tmp.dll
c:\windows\system32\_006026_.tmp.dll
c:\windows\system32\_006027_.tmp.dll
c:\windows\system32\_006028_.tmp.dll
c:\windows\system32\_006030_.tmp.dll
c:\windows\system32\_006031_.tmp.dll
c:\windows\system32\_006032_.tmp.dll
c:\windows\system32\_006033_.tmp.dll
c:\windows\system32\_006034_.tmp.dll
c:\windows\system32\_006035_.tmp.dll
c:\windows\system32\_006036_.tmp.dll
c:\windows\system32\_006039_.tmp.dll
c:\windows\system32\_006041_.tmp.dll
c:\windows\system32\_006042_.tmp.dll
c:\windows\system32\ncase.ini
c:\windows\system32\Packet.dll
c:\windows\system32\Temp
D:\Autorun.inf
G:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2010-12-09 to 2011-01-09 )))))))))))))))))))))))))))))))
.

2071-07-25 13:13 . 2006-11-22 00:48 203576 —-a-w- c:\program files\Microsoft Games\Age of Empires III\autopatcher2.exe
2011-01-09 05:51 . 2011-01-09 05:51 ——– d—–w- c:\program files\ESET
2011-01-09 05:05 . 2011-01-09 05:05 ——– d—–w- C:\_OTL
2011-01-07 07:15 . 2010-11-10 04:33 6273872 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{B90717AC-4A29-4714-9F4B-C347C4FD4035}\mpengine.dll
2011-01-06 05:04 . 2011-01-06 05:04 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Chromium
2011-01-06 05:04 . 2011-01-06 05:04 ——– d—–w- c:\program files\SRWare Iron
2011-01-05 06:45 . 2007-04-30 05:24 61440 —-a-w- c:\windows\system32\digitbox.ocx
2011-01-05 06:45 . 2011-01-05 06:45 ——– d—–w- c:\program files\Alarm
2011-01-03 04:02 . 2011-01-03 04:02 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2011-01-03 03:52 . 2011-01-03 03:52 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Temp
2011-01-02 22:51 . 2011-01-02 22:51 ——– d—–w- c:\windows\Simple Port Forwarding
2011-01-02 22:51 . 2011-01-02 23:11 ——– d—–w- c:\program files\Simple Port Forwarding
2011-01-02 22:37 . 2011-01-02 22:37 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2011-01-02 22:06 . 2011-01-02 22:06 ——– d—–w- c:\program files\Google
2011-01-02 22:06 . 2011-01-02 22:06 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
2011-01-02 22:05 . 2011-01-02 22:05 ——– d—–w- c:\program files\Lavasoft
2011-01-02 21:55 . 2011-01-02 21:55 ——– d—–w- c:\documents and settings\All Users\Application Data\MFAData
2011-01-02 19:10 . 2011-01-02 19:10 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes
2011-01-02 19:10 . 2010-12-20 23:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-02 19:10 . 2011-01-02 19:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-01-02 19:09 . 2010-12-20 23:08 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2011-01-02 19:09 . 2011-01-02 19:10 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-12-22 04:14 . 2010-12-22 04:16 ——– d—–w- c:\documents and settings\Owner\Application Data\FKRMonitor
2010-12-22 04:14 . 2010-12-22 04:14 ——– d—–w- c:\program files\FKRMonitor
2010-12-15 01:21 . 2010-12-15 01:21 69632 —-a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{6B76F16C-850D-4E53-B395-8C0690BA9018}\BlackBerry.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-08 14:33 . 2008-06-01 00:42 36352 —-a-w- c:\windows\system32\drivers\disk.sys
2010-11-10 04:33 . 2007-08-04 03:09 6273872 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2010-10-28 17:23 . 2010-11-27 00:06 2217088 —-a-w- c:\windows\system32\BootMan.exe
2010-10-19 15:41 . 2009-10-03 06:09 222080 ——w- c:\windows\system32\MpSigStub.exe
2005-10-05 19:57 . 2005-10-05 19:57 121 —-a-w- c:\program files\ppunistall.bat
2009-09-25 16:41 . 2009-09-25 16:41 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2009-09-25 16:41 . 2009-09-25 16:41 1044480 —-a-w- c:\program files\opera\program\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41 200704 —-a-w- c:\program files\opera\program\plugins\ssldivx.dll
2002-12-12 07:27 73728 –sha-w- c:\windows\RegisteredPackages\{DD90D410-1823-43EB-9A16-A2331BF08799}$BACKUP$\System\wmplayer.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-26 20:23 1385864 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-26 1385864]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitComet"="g:\bitcomet\BitComet.exe" [2009-03-09 2564408]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-26 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-11-13 15:43 548352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll, zpasspc.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Clean Access Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Clean Access Agent.lnk
backup=c:\windows\pss\Clean Access Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NETGEAR WG111v2 Smart Wizard.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\NETGEAR WG111v2 Smart Wizard.lnk
backup=c:\windows\pss\NETGEAR WG111v2 Smart Wizard.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WDDMStatus.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk
backup=c:\windows\pss\WDDMStatus.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WG111v2 Smart Wizard Wireless Setting.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WG111v2 Smart Wizard Wireless Setting.lnk
backup=c:\windows\pss\WG111v2 Smart Wizard Wireless Setting.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-21 04:07 932288 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 09:47 35760 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AIM]
2009-10-05 19:10 3634024 —-a-w- c:\program files\AIM7\aim.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
2008-04-16 15:37 4608 —-a-w- c:\program files\Alcohol Soft\Alcohol 120\AxCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor]
2004-09-07 18:47 57344 -c–a-w- c:\windows\ALCXMNTR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
2009-03-09 10:32 2564408 —-a-w- g:\bitcomet\BitComet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BlackBerryAutoUpdate]
2009-08-31 16:25 623960 —-a-w- c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\COMODO Firewall Pro]
2009-04-17 13:15 1851128 —-a-w- c:\program files\COMODO\Firewall\cfp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\COMODO Internet Security]
2009-04-17 13:15 1851128 —-a-w- c:\program files\COMODO\Firewall\cfp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 07:56 15360 —-a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fklogger.exe]
2010-02-19 23:36 514560 —-a-w- c:\program files\FKRMonitor\fklogger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2005-06-21 20:44 126976 —-a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2002-11-03 19:56 188416 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
1998-05-07 23:04 52736 —-a-w- c:\windows\system\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2005-06-21 20:48 155648 —-a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-07-13 18:03 292128 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2003-02-12 03:02 61440 —-a-w- c:\hp\KBD\kbd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
2004-09-22 22:20 53248 —-a-w- c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnappau]
2004-08-13 22:41 86016 —-a-w- c:\program files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nmctxth]
2008-12-12 22:06 642856 —-a-w- c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2]
2002-08-01 03:28 81920 —-a-w- c:\windows\system32\ps2.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2008-03-14 23:50 233472 —-a-w- c:\program files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-05-26 21:18 413696 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealPlayer]
2008-05-17 08:27 214560 —-a-w- c:\program files\Real\RealOne Player\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
2002-09-14 04:42 212992 —-a-w- c:\windows\SMINST\Recguard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smp.exe]
2008-12-14 13:29 442664 —-a-w- c:\program files\Pure Networks\Speed Meter Pro\smp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2005-08-26 22:14 36975 —-a-w- c:\program files\Java\jre1.5.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2011-01-02 21:09 2424560 —-a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-05-17 08:26 185896 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ulead AutoDetector]
2003-02-27 23:48 45056 —-a-w- c:\program files\Ulead Systems\Ulead Photo Explorer 8.0 SE Basic\monitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr]
2007-01-04 21:38 112336 —-a-w- c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WildTangent CDA]
2004-05-21 23:12 64512 —-a-w- c:\program files\WildTangent\Apps\CDA\CDAEngine0400.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2006-11-03 23:20 866584 —-a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
2005-08-19 23:34 3084288 —-a-w- c:\program files\Yahoo!\Messenger\YPager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"McAfeeFramework"=2 (0x2)
"GEARSecurity"=2 (0x2)
"Viewpoint Manager Service"=2 (0x2)
"mnmsrvc"=3 (0x3)
"iPod Service"=3 (0x3)
"WDSC"=2 (0x2)
"WDFME"=2 (0x2)
"WDDMService"=2 (0x2)
"SandraTheSrv"=3 (0x3)
"SandraDataSrv"=3 (0x3)
"LexBceS"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"Bonjour Service"=3 (0x3)
"Adobe LM Service"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_03\bin\jusched.exe"
"Lexmark 1200 Series"="c:\program files\Lexmark 1200 Series\lxczbmgr.exe"
"PC Pitstop Optimize Scheduler"=c:\program files\PCPitstop\Optimize\PCPOptimize.exe -boot

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices-]
"WndMsg"=c:\program files\AUTO\klkernel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Documents and Settings\\Owner\\Desktop\\Tim\\quake\\Quake3\\eye\\eye.exe"=
"c:\\Documents and Settings\\Owner\\Desktop\\Tim\\quake\\Quake3\\quake3.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Documents and Settings\\Owner\\My Documents\\IPStealer.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AIM7\\aim.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\BitComet\\BitComet.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"20243:TCP"= 20243:TCP:BitComet 20243 TCP
"20243:UDP"= 20243:UDP:BitComet 20243 UDP
"10575:TCP"= 10575:TCP:BitComet 10575 TCP
"10575:UDP"= 10575:UDP:BitComet 10575 UDP
"65123:TCP"= 65123:TCP:BitComet 65123 TCP
"65123:UDP"= 65123:UDP:BitComet 65123 UDP
"62100:TCP"= 62100:TCP:BitComet 62100 TCP
"62100:UDP"= 62100:UDP:BitComet 62100 UDP
"49344:TCP"= 49344:TCP:BitComet 49344 TCP
"49344:UDP"= 49344:UDP:BitComet 49344 UDP
"62341:TCP"= 62341:TCP:BitComet 62341 TCP
"62341:UDP"= 62341:UDP:BitComet 62341 UDP
"62444:TCP"= 62444:TCP:BitComet 62444 TCP
"62444:UDP"= 62444:UDP:BitComet 62444 UDP
"62333:TCP"= 62333:TCP:BitComet 62333 TCP
"62333:UDP"= 62333:UDP:BitComet 62333 UDP
"62334:TCP"= 62334:TCP:BitComet 62334 TCP
"62334:UDP"= 62334:UDP:BitComet 62334 UDP
"6882:TCP"= 6882:TCP:BitComet 6882 TCP
"6882:UDP"= 6882:UDP:BitComet 6882 UDP
"23051:TCP"= 23051:TCP:BitComet 23051 TCP
"23051:UDP"= 23051:UDP:BitComet 23051 UDP
"67:UDP"= 67:UDP:DHCP Discovery Service
"13743:TCP"= 13743:TCP:BitComet 13743 TCP
"13743:UDP"= 13743:UDP:BitComet 13743 UDP
"49800:TCP"= 49800:TCP:BitComet 49800 TCP
"49800:UDP"= 49800:UDP:BitComet 49800 UDP
"49815:TCP"= 49815:TCP:BitComet 49815 TCP
"49815:UDP"= 49815:UDP:BitComet 49815 UDP
"23144:TCP"= 23144:TCP:BitComet 23144 TCP
"23144:UDP"= 23144:UDP:BitComet 23144 UDP
"63000:TCP"= 63000:TCP:BitComet 63000 TCP
"63000:UDP"= 63000:UDP:BitComet 63000 UDP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [4/16/2008 10:24 AM 716272]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [3/31/2008 9:42 PM 110992]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [3/31/2008 9:42 PM 24336]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2/29/2008 3:03 PM 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/29/2008 3:03 PM 67656]
R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [12/19/2003 3:00 PM 2560]
R2 pnpcap;Pure Networks Packet Capture Driver;c:\windows\system32\drivers\pnpcap.sys [6/4/2010 10:45 PM 23344]
S1 DTC328X;DTC328X;c:\windows\system32\drivers\Dtc328x.sys [8/23/2003 9:51 AM 48648]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/2/2011 5:08 PM 136176]
S2 mrtRate;mrtRate; [x]
S3 DCamUSBVeo532;Veo Web Camera;c:\windows\system32\drivers\ubVeo532.sys [12/25/2003 11:38 AM 95232]
S3 dump_wmimmc;dump_wmimmc;\??\f:\gunbound\Gunbound Revolution\GameGuard\dump_wmimmc.sys –> f:\gunbound\Gunbound Revolution\GameGuard\dump_wmimmc.sys [?]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [11/26/2010 7:06 PM 13192]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [11/26/2010 7:06 PM 8456]
S3 PCDRDRV;Pcdr Helper Driver; [x]
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [4/16/2008 11:59 AM 272128]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 3:51 PM 12872]
S3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [4/16/2008 11:59 AM 13532]
S3 ultradfg;ultradfg;c:\windows\system32\drivers\ultradfg.sys [3/9/2008 6:26 AM 23040]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [11/26/2010 4:58 PM 11520]
S3 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 6:19 PM 13592]
S4 Amsdumrsucsu;Amsdumrsucsu;c:\windows\system32\drivers\modem.sys [5/31/2008 7:42 PM 30080]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [12/30/2008 10:11 PM 24652]
S4 WDDMService;WDDMService;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [9/8/2010 10:41 AM 237056]
S4 WDFME;WD File Management Engine;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe [9/8/2010 10:45 AM 1034752]
S4 WDSC;WD File Management Shadow Engine;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [9/8/2010 10:44 AM 484352]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder

2011-01-09 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-02-29 18:24]

2011-01-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-02 22:06]

2011-01-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-02 22:06]

2011-01-09 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]

2011-01-09 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-05-26 20:23]
.
.
——- Supplementary Scan ——-
.
uStart Page = google.com
uInternet Connection Wizard,ShellNext = iexplore
IE: &AIM; Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
IE: &D;&ownload; &with; BitComet - g:\bitcomet\BitComet.exe/AddLink.htm
IE: &D;&ownload; all video with BitComet - g:\bitcomet\BitComet.exe/AddVideo.htm
IE: &D;&ownload; all with BitComet - g:\bitcomet\BitComet.exe/AddAllLink.htm
TCP: {39F367EC-7002-4DEA-B1F7-7CBDAE6990D6} = 208.67.222.222,208.67.220.220
TCP: {40033D2F-928D-43B4-AF7D-B35FE15E0DC4} = 208.67.222.222,208.67.220.220
TCP: {BE030BCA-61E8-434C-BC00-A1B9994009E9} = 208.67.222.222,208.67.220.220
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\pbf9imzw.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://en-US.start3.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 50370
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 200000
FF - user.js: content.notify.interval - 100000
FF - user.js: content.switch.threshold - 650000
FF - user.js: nglayout.initialpaint.delay - 300
FF - user.js: network.protocol-handler.warn-external.dnupdate - false
.
- - - - ORPHANS REMOVED - - - -

HKU-Default-Run-MSMSGS - c:\program files\Messenger\msmsgs.exe
HKU-Default-RunOnce-Winsock2 driver - SYSENGR.EXE
SafeBoot-klmdb.sys
SafeBoot-Lavasoft Ad-Aware Service
MSConfigStartUp-Aim6 - c:\program files\AIM6\aim6.exe
MSConfigStartUp-AltnetPointsManager - c:\program files\altnet\points manager\points manager.exe
MSConfigStartUp-AnyDVD - c:\program files\SlySoft\AnyDVD\AnyDVD.exe
MSConfigStartUp-ares - c:\program files\Ares\Ares.exe
MSConfigStartUp-Belt - c:\windows\Belt.exe
MSConfigStartUp-CSV7P17 - c:\program files\CSBB\CSV7P17.exe
MSConfigStartUp-DeadAIM - c:\program files\AIM\\DeadAIM.ocm
MSConfigStartUp-gcasServ - c:\program files\Microsoft AntiSpyware\gcasServ.exe
MSConfigStartUp-gdmfijgf - c:\windows\gdmfijgf.exe
MSConfigStartUp-Hotbar - c:\program files\Hotbar\bin\4.5.1.0\HbInst.exe
MSConfigStartUp-InstantAccess - c:\progra~1\TEXTBR~1.0\Bin\INSTAN~1.EXE
MSConfigStartUp-McAfeeUpdaterUI - c:\program files\Network Associates\Common Framework\UpdaterUI.exe
MSConfigStartUp-Microsoft Works Update Detection - c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
MSConfigStartUp-MSMSGS - c:\program files\Messenger\msmsgs.exe
MSConfigStartUp-New - c:\progra~1\NEWDOT~1\NEWDOT~1.DLL
MSConfigStartUp-nkenkoxcml - c:\windows\System32\uodnsjxm.exe
MSConfigStartUp-POINTER - point32.exe
MSConfigStartUp-RegSweep - c:\program files\RegSweep\RegSweep.exe
MSConfigStartUp-saap - c:\windows\ioneei~1\saap.exe
MSConfigStartUp-ShStatEXE - c:\program files\Network Associates\VirusScan\SHSTAT.EXE
MSConfigStartUp-taskmngr - c:\progra~1\common~1\Updates\msnve.exe
MSConfigStartUp-TV Media - c:\program files\TV Media\Tvm.exe
MSConfigStartUp-WeatherOnTray - c:\program files\Hotbar\bin\4.5.1.0\WeatherOnTray.exe
MSConfigStartUp-windows auto update - msblast.exe
MSConfigStartUp-WndMsg - c:\program files\AUTO\klkernel.exe
AddRemove-BitComet Acceleration Patch_is1 - f:\bitcomet\BitComet Acceleration Patch\unins000.exe
AddRemove-D-Fend v2 - f:\hugo1\D-Fend v2\uninstall.exe
AddRemove-Half-Life - c:\documents and settings\owner\desktop\tim\half\Uninst.isu
AddRemove-Network Play System (Patching) - c:\program files\Electronic Arts\Network Play System\NPSPatch.isu
AddRemove-Videora Xbox 360 Converter - f:\videora\Video Converter App\uninstaller.exe
AddRemove-{C3113E55-7BCB-4de3-8EBF-60E6CE6B2096}_is1 - f:\sisoftware sandra lite xii.sp1\unins000.exe
AddRemove-ijji FireFox Launcher - c:\documents and settings\All Users\Application Data\IJJIGame\uninst.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-09 09:00
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwClose, ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\.application\bootstrap]
@DACL=(02 0000)
@="bootstrap.application.1"

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y;@^t! #^$ g9^$&pgb; SDB36o \DA9879757777DAE8]
"1"=hex:ed,4b,4a,ed,15,23,49,74,5a,62,6c,ea,06,f6,a6,df
"2"=hex:a9,40,80,f3,45,2c,d5,a1,17,53,11,d7,21,de,a4,9e,70,5f,a0,52,5b,27,ae,
65,1c,9d,59,02,eb,37,2c,7a,87,23,4c,1a,3f,83,53,96
"3"=hex:ed,4b,4a,ed,15,23,49,74,b0,26,52,ff,a0,7d,07,31,e6,5f,d4,da,fb,3f,90,
71,75,14,ea,42,77,9a,7a,ec,d4,b7,cc,3b,f4,0a,33,5b,a4,1e,da,46,25,2d,2a,72,\

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387]
"1"=hex:1a,dd,98,10,b1,7c,5d,e1
"2"=hex:af,4a,de,61,0e,7b,66,a4
"3"=hex:7e,f8,5f,10,08,67,b4,11,b8,8c,d5,fa,9b,a0,23,2e,e0,fa,2b,28,e9,2e,fd,
d4,ed,db,09,47,d2,c8,6f,c7,57,be,dc,ea,f6,67,72,9e,09,4a,ca,ac,05,3b,2d,b6,\
"4"=hex:2f,ad,a2,e7,8a,bf,05,5e
"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,
1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\
"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,
51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20
"7"=hex:ed,4b,4a,ed,15,23,49,74,5a,02,d0,c7,f9,dd,f2,e5,3e,e0,99,3d,a8,68,9c,
4f,1f,71,fc,13,23,3b,2c,6b,94,db,ee,08,97,0d,d7,27,bf,b9,1b,eb,26,77,8c,fe,\
"8"=hex:e3,36,21,8b,47,07,6d,39,53,04,16,c8,0c,ba,71,42,07,af,eb,7e,87,75,7c,
c3,00,f4,8b,c0,a8,16,bb,53,af,5d,a4,e9,84,f0,0f,66,b6,5a,7b,cc,d8,ff,1d,5d,\
"9"=hex:81,20,8f,ab,28,6a,52,9c
"18"=hex:b6,dd,00,4d,9d,38,11,d1
"10"=hex:1c,bd,ea,59,8e,8d,e1,5f
"11"=hex:81,20,8f,ab,28,6a,52,9c
"12"=hex:81,20,8f,ab,28,6a,52,9c
"13"=hex:81,20,8f,ab,28,6a,52,9c
"14"=hex:81,20,8f,ab,28,6a,52,9c
"24"=hex:81,20,8f,ab,28,6a,52,9c
"26"=hex:81,20,8f,ab,28,6a,52,9c
"19"=hex:81,20,8f,ab,28,6a,52,9c
"22"=hex:81,20,8f,ab,28,6a,52,9c
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(668)
c:\windows\system32\guard32.dll
c:\windows\system32\RtlGina2.dll
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll

- - - - - - - > 'lsass.exe'(728)
c:\windows\system32\guard32.dll

- - - - - - - > 'explorer.exe'(2652)
c:\windows\system32\WININET.dll
c:\windows\system32\guard32.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\System32\TuneUpDefragService.exe
c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
.
**************************************************************************
.
Completion time: 2011-01-09 09:08:04 - machine was rebooted
ComboFix-quarantined-files.txt 2011-01-09 14:07

Pre-Run: 3,838,308,352 bytes free
Post-Run: 3,728,101,376 bytes free

- - End Of File - - 59BA0A25F867E638071701825C8BD5C8

mowman

Post #8January 10, 2011, 2:10 PM UTC

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

Firefox::

FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\pbf9imzw.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 50370
FF - prefs.js: network.proxy.type - 0

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
If you need help to disable your protection programs see here.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Now try an updated MBAM scan and ESET again.Do you have any antivirus installed on this machine?

Timo529

Post #9January 10, 2011, 3:02 PM UTC last edited January 10, 2011, 6:36 PM UTC

Combo Fix Log —————————- ComboFix 11-01-08.04 - Owner 01/10/2011 9:34.2.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1015.652 [GMT -5:00] Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt FW: COMODO Firewall *Enabled* {043803A3-4F86-4ef6-AFC5-F6E02A79969B} . ((((((((((((((((((((((((( Files Created from 2010-12-10 to 2011-01-10 ))))))))))))))))))))))))))))))) . 2071-07-25 13:13 . 2006-11-22 00:48 203576 —-a-w- c:\program files\Microsoft Games\Age of Empires III\autopatcher2.exe 2011-01-09 05:51 . 2011-01-09 05:51 ——– d—–w- c:\program files\ESET 2011-01-09 05:05 . 2011-01-09 05:05 ——– d—–w- C:\_OTL 2011-01-07 07:15 . 2010-11-10 04:33 6273872 —-a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{B90717AC-4A29-4714-9F4B-C347C4FD4035}\mpengine.dll 2011-01-06 05:04 . 2011-01-06 05:04 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Chromium 2011-01-06 05:04 . 2011-01-06 05:04 ——– d—–w- c:\program files\SRWare Iron 2011-01-05 06:45 . 2007-04-30 05:24 61440 —-a-w- c:\windows\system32\digitbox.ocx 2011-01-05 06:45 . 2011-01-05 06:45 ——– d—–w- c:\program files\Alarm 2011-01-03 04:02 . 2011-01-03 04:02 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google 2011-01-03 03:52 . 2011-01-03 03:52 ——– d—–w- c:\documents and settings\Owner\Local Settings\Application Data\Temp 2011-01-02 22:51 . 2011-01-02 22:51 ——– d—–w- c:\windows\Simple Port Forwarding 2011-01-02 22:51 . 2011-01-09 19:47 ——– d—–w- c:\program files\Simple Port Forwarding 2011-01-02 22:37 . 2011-01-02 22:37 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Google 2011-01-02 22:06 . 2011-01-02 22:06 ——– d—–w- c:\program files\Google 2011-01-02 22:06 . 2011-01-02 22:06 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{2162CCC0-3A5F-4887-B51F-CE5F195B3620} 2011-01-02 22:05 . 2011-01-02 22:05 ——– d—–w- c:\program files\Lavasoft 2011-01-02 21:55 . 2011-01-02 21:55 ——– d—–w- c:\documents and settings\All Users\Application Data\MFAData 2011-01-02 19:10 . 2011-01-02 19:10 ——– d—–w- c:\documents and settings\Owner\Application Data\Malwarebytes 2011-01-02 19:10 . 2010-12-20 23:09 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2011-01-02 19:10 . 2011-01-02 19:10 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes 2011-01-02 19:09 . 2010-12-20 23:08 20952 —-a-w- c:\windows\system32\drivers\mbam.sys 2011-01-02 19:09 . 2011-01-02 19:10 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware 2010-12-22 04:14 . 2010-12-22 04:16 ——– d—–w- c:\documents and settings\Owner\Application Data\FKRMonitor 2010-12-22 04:14 . 2010-12-22 04:14 ——– d—–w- c:\program files\FKRMonitor 2010-12-15 01:21 . 2010-12-15 01:21 69632 —-a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{6B76F16C-850D-4E53-B395-8C0690BA9018}\BlackBerry.exe Was still not able to update malwarebytes or run ESET. I have super antispyware installed on the computer and adaware(although since i updated adaware it no longer will open) I figured out what the problem was.. I feel like such an idiot I stopped using comodo firewall a LONG time ago but apparently it was still running in the background(no taskbar icon or anything) I opened it just to try it out and disabled it from inside of it and now i was able to update malwarebytes and i'm running eset online scanner now. Will post logs when complete

Timo529

Post #10January 10, 2011, 8:08 PM UTC

Malwarebytes ——————— Found nothing Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5497 Windows 5.1.2600 Service Pack 2 Internet Explorer 8.0.6001.18702 1/10/2011 1:28:25 PM mbam-log-2011-01-10 (13-28-25).txt Scan type: Quick scan Objects scanned: 137849 Time elapsed: 11 minute(s), 11 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ESET —————- It didn't give me a scan summary at the end but it did find 14 other infections and cleaned them

mowman

Post #11January 11, 2011, 2:26 AM UTC

Do you have any antivirus installed on this machine?

You didn't answer this

Is that all the combofix log,alot of it is missing,also post a new otl log and tell me how the computer is running now.

Timo529

Post #12January 12, 2011, 1:06 AM UTC

Yea I said i had super antispyware and adware
I posted all the info that combofix gave me.
But here is the OTL log
OTL logfile created on: 1/11/2011 7:44:50 PM - Run 3
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,015.00 Mb Total Physical Memory | 426.00 Mb Available Physical Memory | 42.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 33.35 Gb Total Space | 2.94 Gb Free Space | 8.80% Space Free | Partition Type: NTFS
Drive D: | 3.90 Gb Total Space | 1.28 Gb Free Space | 32.72% Space Free | Partition Type: FAT32

Computer Name: YOUR-B79WZ4ROSE | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
PRC - C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
PRC - C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files\FKRMonitor\fklogger.exe ()
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
PRC - C:\zMUD\Zmud.exe (Zugg Software)
PRC - C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software GmbH)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
PRC - C:\WINDOWS\Runservice.exe ()

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Owner\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\guard32.dll (COMODO)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcp80.dll (Microsoft Corporation)
MOD - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
MOD - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\rsaenh.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (SandraTheSrv) – F:\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe File not found
SRV - (SandraDataSrv) – F:\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe File not found
SRV - (Imapi Helper) – F:\isoburener\ImapiHelper.exe File not found
SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (AppMgmt) – C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (cmdAgent) – C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (COMODO)
SRV - (WDFME) – C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe ()
SRV - (WDSC) – C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe ()
SRV - (WDDMService) – C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC)
SRV - (nmservice) – C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Cisco Systems, Inc.)
SRV - (TuneUp.Defrag) – C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software GmbH)
SRV - (UxTuneUp) – C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV - (LicCtrlService) – C:\WINDOWS\Runservice.exe ()
SRV - (GEARSecurity) – C:\WINDOWS\system32\gearsec.exe (GEAR Software)

========== Driver Services (SafeList) ==========

DRV - (dump_wmimmc) – F:\gunbound\Gunbound Revolution\GameGuard\dump_wmimmc.sys File not found
DRV - (catchme) – C:\ComboFix\catchme.sys File not found
DRV - (Inspect) – C:\WINDOWS\System32\DRIVERS\inspect.sys (COMODO)
DRV - (cmdHlp) – C:\WINDOWS\system32\drivers\cmdhlp.sys (COMODO)
DRV - (cmdGuard) – C:\WINDOWS\system32\drivers\cmdGuard.sys (COMODO)
DRV - (epmntdrv) – C:\WINDOWS\system32\epmntdrv.sys ()
DRV - (EuGdiDrv) – C:\WINDOWS\system32\EuGdiDrv.sys ()
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM) – C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (WDC_SAM) – C:\WINDOWS\system32\drivers\wdcsam.sys (Western Digital Technologies)
DRV - (pnpcap) – C:\WINDOWS\system32\drivers\pnpcap.sys (Cisco Systems, Inc.)
DRV - (purendis) – C:\WINDOWS\system32\drivers\purendis.sys (Cisco Systems, Inc.)
DRV - (pnarp) – C:\WINDOWS\system32\drivers\pnarp.sys (Cisco Systems, Inc.)
DRV - (MxlW2k) – C:\WINDOWS\System32\drivers\MxlW2k.sys (MusicMatch, Inc.)
DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (SCDEmu) – C:\WINDOWS\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (ultradfg) – C:\WINDOWS\system32\drivers\ultradfg.sys (DASoft Development Team)
DRV - (RTLWUSB) – C:\WINDOWS\system32\drivers\wg111v2.sys (NETGEAR Inc.)
DRV - (tmcomm) – C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.)
DRV - (RT73) – C:\WINDOWS\system32\drivers\rt73.sys (Ralink Technology, Corp.)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) – C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\rtl8139.sys (Realtek Semiconductor Corporation)
DRV - (S3Psddr) – C:\WINDOWS\system32\drivers\s3gnbm.sys (S3 Graphics, Inc.)
DRV - (SNDO763) – C:\WINDOWS\system32\drivers\sndo763.sys ()
DRV - (ALCXSENS) – C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura Ltd)
DRV - (NPPTNT) – C:\WINDOWS\system32\npptNT.sys (INCA Internet Co., Ltd.)
DRV - (ltmodem5) – C:\WINDOWS\system32\drivers\ltmdmnt.sys (LT)
DRV - (viaagp1) – C:\WINDOWS\System32\DRIVERS\viaagp1.sys (VIA Technologies, Inc.)
DRV - (SjyPkt) – C:\WINDOWS\system32\drivers\SjyPkt.sys (Windows ® 2000 DDK provider)
DRV - (Ps2) – C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company)
DRV - (DCamUSBVeo532) – C:\WINDOWS\system32\drivers\ubVeo532.sys (IC Media Corporation)
DRV - (IPFilter) – C:\WINDOWS\system32\drivers\ipfilter.sys (Microsoft Corporation)
DRV - (irsir) – C:\WINDOWS\system32\drivers\irsir.sys (Microsoft Corporation)
DRV - (DTC328X) – C:\WINDOWS\System32\drivers\DTC328X.SYS (Microsoft Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.microsoft.com/search/search.asp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Data = C3 17 11 E0 B2 A4 AC 29 3E F1 D7 B3 41 B1 26 5E 77 7F FB 0D C7 48 7E BE 12 BE E1 AD BE 28 [binary data]
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: [removed]:1.10
FF - prefs.js..extensions.enabledItems: [removed]:0.20
FF - prefs.js..extensions.enabledItems: {567F62D2-2162-43fe-A573-E5620D0934B2}:1.6
FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.08
FF - prefs.js..extensions.enabledItems: {F5CEF9AD-F6AF-4b69-AB6D-936BF6BCB6D7}:1.5
FF - prefs.js..network.proxy.type: 4

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealOne Player\browserrecord [2008/05/17 03:31:46 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/11 16:25:34 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/10 18:47:59 | 000,000,000 | —D | M]

[2008/06/20 19:15:11 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2011/01/11 07:25:50 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\pbf9imzw.default\extensions
[2010/04/27 19:04:03 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\pbf9imzw.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2008/03/09 13:27:08 | 000,000,000 | —D | M] (MidnightFox) – C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\pbf9imzw.default\extensions\{66871bd1-5ba2-4739-b485-2a15f5969bd8}(2)
[2011/01/11 07:25:50 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
File not found (No name found) – C:\PROGRAM FILES\COMETBIRD\EXTENSIONS\{567F62D2-2162-43FE-A573-E5620D0934B2}
File not found (No name found) – C:\PROGRAM FILES\COMETBIRD\EXTENSIONS\{B042753D-F57E-4E8E-A01B-7379A6D4CEFB}
File not found (No name found) – C:\PROGRAM FILES\COMETBIRD\EXTENSIONS\{F5CEF9AD-F6AF-4B69-AB6D-936BF6BCB6D7}
File not found (No name found) – C:\PROGRAM FILES\COMETBIRD\EXTENSIONS\[removed]
File not found (No name found) – C:\PROGRAM FILES\COMETBIRD\EXTENSIONS\[removed]
[2010/08/24 04:31:30 | 000,773,120 | —- | M] (BitComet) – C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2007/07/25 03:51:06 | 000,164,352 | —- | M] (Indiepath Ltd) – C:\Program Files\Mozilla Firefox\plugins\npigl.dll
[2009/05/20 00:49:50 | 000,083,376 | —- | M] (NHN USA Inc.) – C:\Program Files\Mozilla Firefox\plugins\npijjiautoinstallpluginff.dll
[2009/05/27 15:41:50 | 000,069,632 | —- | M] (NHN USA Inc. ) – C:\Program Files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
[2007/04/16 12:07:12 | 000,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: ([2011/01/09 08:59:48 | 000,000,027 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealOne Player\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\BitComet\tools\BitCometBHO_1.4.11.9.dll (BitComet)
O2 - BHO: (ST) - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll (Microsoft Corporation)
O2 - BHO: (MSNToolBandBHO) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (Microsoft Corporation)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (MSN) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (&Yahoo;! Companion) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (MSN) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Yahoo;! Companion) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKCU..\Run: [BitComet] G:\BitComet\BitComet.exe File not found
O4 - HKCU..\Run: [fklogger.exe] C:\Program Files\FKRMonitor\fklogger.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (America Online, Inc.)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe File not found
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe File not found
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\BitComet\tools\BitCometBHO_1.4.11.9.dll (BitComet)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\NewDotNet\newdotnet6_38.dll File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll File not found
O15 - HKCU\..Trusted Ranges: Range1979 ([http] in Trusted sites)
O16 - DPF: {00000075-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/voxacm.CAB (Reg Error: Key error.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} http://us.chat1.yimg.com/us.yimg.com/i/cha…v45/yacscom.cab (Yahoo! Audio Conferencing)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} http://download.yahoo.com/dl/installs/yinst0401.cab (YInstStarter Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} http://chat.yahoo.com/cab/yacsui.cab (Yahoo! Audio UI1)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…t/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/…7811.3900810185 (Reg Error: Key error.)
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll (Reg Error: Key error.)
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} http://www.crucial.com/controls/cpcScanner.cab (Crucial cpcScan)
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} http://fdl.msn.com/zone/datafiles/heartbeat.cab (HeartbeatCtl Class)
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} http://www.srtest.com/sysreqlab.cab (System Requirements Lab Class)
O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} http://java.sun.com/products/plugin/1.4/ji…indows-i586.cab (Java Plug-in 1.4.1_02)
O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://l.yimg.com/jh/games/web_games/popca…aploader_v6.cab (Reg Error: Key error.)
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: JT's Blocks http://download.games.yahoo.com/games/clients/y/blt1_x.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: Yahoo! Chat http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab (Reg Error: Key error.)
O16 - DPF: Yahoo! Poker http://download.games.yahoo.com/games/clients/y/pt0_x.cab (Reg Error: Key error.)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O20 - AppInit_DLLs: (C:\WINDOWS\system32\guard32.dll) - C:\WINDOWS\system32\guard32.dll (COMODO)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (RtlGina2.dll) - C:\WINDOWS\System32\RtlGina2.dll ()
O20 - HKLM Winlogon: UIHost - (C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe) - C:\Documents and Settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O29 - HKLM SecurityProviders - (zwebauth.dll) - C:\WINDOWS\System32\ZWebAuth.dll ()
O29 - HKLM SecurityProviders - (zpasspc.dll) - C:\WINDOWS\System32\zpasspc.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/02/26 14:49:14 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2001/07/28 06:07:38 | 000,000,000 | RHS- | M] () - D:\AUTOEXEC.BAT – [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/01/10 15:14:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\COMODO
[2011/01/10 13:33:18 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Start Menu\Programs\Google Chrome
[2011/01/10 12:40:03 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2011/01/10 09:52:49 | 000,000,000 | —D | C] – C:\WINDOWS\temp
[2011/01/09 08:33:21 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2011/01/09 08:33:21 | 000,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2011/01/09 08:33:21 | 000,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2011/01/09 08:33:21 | 000,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2011/01/09 08:32:43 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2011/01/09 08:32:11 | 000,000,000 | —D | C] – C:\Qoobox
[2011/01/09 00:51:54 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/01/09 00:05:55 | 000,000,000 | —D | C] – C:\_OTL
[2011/01/08 09:28:55 | 001,345,624 | —- | C] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\TDSSKiller.exe
[2011/01/07 22:14:56 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/01/06 00:04:52 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\SRWare Iron
[2011/01/06 00:04:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Chromium
[2011/01/06 00:04:35 | 000,000,000 | —D | C] – C:\Program Files\SRWare Iron
[2011/01/05 01:45:56 | 000,061,440 | —- | C] (Windswept Software) – C:\WINDOWS\System32\digitbox.ocx
[2011/01/05 01:45:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Alarm
[2011/01/05 01:45:55 | 000,000,000 | —D | C] – C:\Program Files\Alarm
[2011/01/02 23:02:01 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2011/01/02 22:52:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Local Settings\Application Data\Temp
[2011/01/02 17:51:27 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Start Menu\Programs\Simple Port Forwarding
[2011/01/02 17:51:19 | 000,000,000 | —D | C] – C:\WINDOWS\Simple Port Forwarding
[2011/01/02 17:51:18 | 000,000,000 | —D | C] – C:\Program Files\Simple Port Forwarding
[2011/01/02 17:37:20 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2011/01/02 17:06:27 | 000,000,000 | —D | C] – C:\Program Files\Google
[2011/01/02 17:06:19 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\{2162CCC0-3A5F-4887-B51F-CE5F195B3620}
[2011/01/02 17:05:29 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Lavasoft
[2011/01/02 17:05:28 | 000,000,000 | —D | C] – C:\Program Files\Lavasoft
[2011/01/02 16:55:43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/01/02 16:55:33 | 004,622,344 | —- | C] (AVG Technologies) – C:\Documents and Settings\Owner\My Documents\avg_free_stb_all_2011_1191_cnet.exe
[2011/01/02 14:10:34 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\Malwarebytes
[2011/01/02 14:10:05 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/01/02 14:10:04 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/01/02 14:10:01 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/01/02 14:09:52 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/01/02 14:09:51 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/12/29 01:42:04 | 000,285,480 | —- | C] (COMODO) – C:\WINDOWS\System32\guard32.dll
[2010/12/29 01:41:28 | 000,094,656 | —- | C] (COMODO) – C:\WINDOWS\System32\drivers\inspect.sys
[2010/12/29 01:41:28 | 000,027,576 | —- | C] (COMODO) – C:\WINDOWS\System32\drivers\cmdhlp.sys
[2010/12/29 01:41:26 | 000,239,368 | —- | C] (COMODO) – C:\WINDOWS\System32\drivers\cmdGuard.sys
[2010/12/29 01:41:26 | 000,015,592 | —- | C] (COMODO) – C:\WINDOWS\System32\drivers\cmderd.sys
[2010/12/21 23:14:56 | 000,000,000 | —D | C] – C:\Documents and Settings\Owner\Application Data\FKRMonitor
[2010/12/21 23:14:52 | 000,000,000 | —D | C] – C:\Program Files\FKRMonitor
[2004/12/25 10:18:20 | 000,036,864 | —- | C] ( ) – C:\WINDOWS\System32\vsndo763.dll
[7 C:\WINDOWS\Fonts\*.tmp files -> C:\WINDOWS\Fonts\*.tmp -> ]
[3 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/01/11 19:37:08 | 000,000,978 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1620374358-65161857-3063940977-1003UA.job
[2011/01/11 19:02:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/01/11 19:01:01 | 000,000,234 | —- | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/01/11 19:00:00 | 000,000,486 | —- | M] () – C:\WINDOWS\tasks\1-Click Maintenance.job
[2011/01/11 17:15:45 | 000,000,634 | —- | M] () – C:\Documents and Settings\All Users\Desktop\mIRC.lnk
[2011/01/11 13:37:03 | 000,000,926 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1620374358-65161857-3063940977-1003Core.job
[2011/01/11 02:22:10 | 000,000,330 | -H– | M] () – C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/01/10 23:02:02 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/01/10 15:32:52 | 000,000,801 | -HS- | M] () – C:\WINDOWS\System32\mmf.sys
[2011/01/10 15:32:31 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/01/10 15:14:59 | 000,001,653 | —- | M] () – C:\Documents and Settings\All Users\Desktop\COMODO Firewall.lnk
[2011/01/10 13:33:45 | 000,002,292 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Google Chrome.lnk
[2011/01/10 13:33:45 | 000,002,270 | —- | M] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/01/09 08:59:48 | 000,000,027 | —- | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2011/01/09 08:30:16 | 004,151,000 | R— | M] () – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2011/01/09 08:14:39 | 000,098,816 | —- | M] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/01/09 00:51:41 | 002,672,312 | —- | M] () – C:\Documents and Settings\Owner\Desktop\esetsmartinstaller_enu.exe
[2011/01/08 09:28:24 | 001,232,020 | —- | M] () – C:\Documents and Settings\Owner\Desktop\tdsskiller.zip
[2011/01/07 22:36:58 | 000,359,929 | —- | M] () – C:\Documents and Settings\Owner\Desktop\dds.scr
[2011/01/07 22:15:47 | 000,000,460 | RHS- | M] () – C:\boot.ini
[2011/01/07 22:14:51 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/01/06 00:04:53 | 000,000,687 | —- | M] () – C:\Documents and Settings\All Users\Desktop\SRWare Iron.lnk
[2011/01/05 01:45:56 | 000,000,686 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Alarm.lnk
[2011/01/02 21:44:15 | 000,000,833 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Shortcut to Heroes3.exe.lnk
[2011/01/02 17:51:34 | 000,001,641 | —- | M] () – C:\Documents and Settings\Owner\Desktop\Simple Port Forwarding.lnk
[2011/01/02 17:06:17 | 000,000,875 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2011/01/02 16:55:35 | 004,622,344 | —- | M] (AVG Technologies) – C:\Documents and Settings\Owner\My Documents\avg_free_stb_all_2011_1191_cnet.exe
[2011/01/02 14:10:07 | 000,000,792 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/01/01 11:11:00 | 000,000,600 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Opera.lnk
[2010/12/29 01:42:04 | 000,285,480 | —- | M] (COMODO) – C:\WINDOWS\System32\guard32.dll
[2010/12/29 01:41:28 | 000,094,656 | —- | M] (COMODO) – C:\WINDOWS\System32\drivers\inspect.sys
[2010/12/29 01:41:28 | 000,027,576 | —- | M] (COMODO) – C:\WINDOWS\System32\drivers\cmdhlp.sys
[2010/12/29 01:41:26 | 000,239,368 | —- | M] (COMODO) – C:\WINDOWS\System32\drivers\cmdGuard.sys
[2010/12/29 01:41:26 | 000,015,592 | —- | M] (COMODO) – C:\WINDOWS\System32\drivers\cmderd.sys
[2010/12/20 18:09:00 | 000,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/12/16 09:47:52 | 001,345,624 | —- | M] (Kaspersky Lab ZAO) – C:\Documents and Settings\Owner\Desktop\TDSSKiller.exe
[2010/12/14 22:02:20 | 000,000,256 | —- | M] () – C:\WINDOWS\System32\pool.bin
[2010/12/14 20:37:30 | 005,165,625 | —- | M] () – C:\Documents and Settings\Owner\My Documents\LoaderBackup-(2010-12-14).ipd
[2010/12/14 20:28:59 | 005,135,070 | —- | M] () – C:\Documents and Settings\Owner\My Documents\Backup-(2010-12-14).ipd
[3 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/01/11 17:15:44 | 000,000,634 | —- | C] () – C:\Documents and Settings\All Users\Desktop\mIRC.lnk
[2011/01/10 15:14:59 | 000,001,653 | —- | C] () – C:\Documents and Settings\All Users\Desktop\COMODO Firewall.lnk
[2011/01/10 13:33:45 | 000,002,292 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Google Chrome.lnk
[2011/01/10 13:33:45 | 000,002,270 | —- | C] () – C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/01/10 13:32:18 | 000,000,978 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1620374358-65161857-3063940977-1003UA.job
[2011/01/10 13:32:16 | 000,000,926 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1620374358-65161857-3063940977-1003Core.job
[2011/01/09 08:33:21 | 000,256,512 | —- | C] () – C:\WINDOWS\PEV.exe
[2011/01/09 08:33:21 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2011/01/09 08:33:21 | 000,089,088 | —- | C] () – C:\WINDOWS\MBR.exe
[2011/01/09 08:33:21 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2011/01/09 08:33:21 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2011/01/09 08:30:22 | 004,151,000 | R— | C] () – C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2011/01/09 00:51:39 | 002,672,312 | —- | C] () – C:\Documents and Settings\Owner\Desktop\esetsmartinstaller_enu.exe
[2011/01/08 09:28:30 | 001,232,020 | —- | C] () – C:\Documents and Settings\Owner\Desktop\tdsskiller.zip
[2011/01/07 22:37:08 | 000,359,929 | —- | C] () – C:\Documents and Settings\Owner\Desktop\dds.scr
[2011/01/06 00:04:53 | 000,000,687 | —- | C] () – C:\Documents and Settings\All Users\Desktop\SRWare Iron.lnk
[2011/01/05 01:45:56 | 000,000,686 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Alarm.lnk
[2011/01/02 22:57:28 | 000,000,886 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/01/02 21:44:15 | 000,000,833 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Shortcut to Heroes3.exe.lnk
[2011/01/02 17:51:34 | 000,001,641 | —- | C] () – C:\Documents and Settings\Owner\Desktop\Simple Port Forwarding.lnk
[2011/01/02 17:12:09 | 000,000,880 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/01/02 17:06:17 | 000,000,875 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2011/01/02 14:10:07 | 000,000,792 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/14 20:37:29 | 005,165,625 | —- | C] () – C:\Documents and Settings\Owner\My Documents\LoaderBackup-(2010-12-14).ipd
[2010/12/14 20:28:59 | 005,135,070 | —- | C] () – C:\Documents and Settings\Owner\My Documents\Backup-(2010-12-14).ipd
[2010/11/26 19:06:03 | 000,014,848 | —- | C] () – C:\WINDOWS\System32\EuEpmGdi.dll
[2010/11/26 19:06:03 | 000,013,192 | —- | C] () – C:\WINDOWS\System32\epmntdrv.sys
[2010/11/26 19:06:03 | 000,008,456 | —- | C] () – C:\WINDOWS\System32\EuGdiDrv.sys
[2010/11/26 17:52:58 | 000,106,264 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/06/04 22:37:33 | 008,673,792 | —- | C] () – C:\Documents and Settings\All Users\Application Data\atscie.msi
[2008/04/16 10:24:14 | 000,716,272 | —- | C] () – C:\WINDOWS\System32\drivers\sptd.sys
[2008/03/09 16:02:43 | 000,000,067 | —- | C] () – C:\WINDOWS\AVIConverter.INI
[2008/03/09 06:26:20 | 000,091,648 | —- | C] () – C:\WINDOWS\System32\lua5.1a.dll
[2008/01/12 00:27:59 | 000,001,357 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2007/12/10 02:03:11 | 000,034,308 | —- | C] () – C:\WINDOWS\System32\BASSMOD.dll
[2007/08/09 13:37:05 | 000,043,520 | —- | C] () – C:\WINDOWS\System32\CmdLineExt03.dll
[2007/08/03 23:37:36 | 000,000,021 | —- | C] () – C:\WINDOWS\atid.ini
[2007/01/15 13:24:28 | 000,000,180 | —- | C] () – C:\WINDOWS\dellstat.ini
[2007/01/15 13:24:25 | 000,000,389 | —- | C] () – C:\WINDOWS\lexstat.ini
[2007/01/15 13:23:35 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxczvs.dll
[2007/01/15 13:22:31 | 000,000,270 | —- | C] () – C:\WINDOWS\System32\lxczcoin.ini
[2006/05/03 17:44:32 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\RtlGina2.dll
[2005/10/05 14:57:26 | 000,000,121 | —- | C] () – C:\Program Files\ppunistall.bat
[2005/02/24 02:00:59 | 000,000,044 | —- | C] () – C:\WINDOWS\liveup.ini
[2005/02/02 02:53:23 | 000,000,784 | —- | C] () – C:\Documents and Settings\Owner\Application Data\mpauth.dat
[2005/01/27 00:33:46 | 000,012,288 | —- | C] () – C:\WINDOWS\impborl.dll
[2005/01/03 01:07:42 | 000,000,026 | —- | C] () – C:\WINDOWS\ulead32.ini
[2004/12/25 11:46:29 | 000,000,071 | —- | C] () – C:\WINDOWS\pex.INI
[2004/12/25 10:18:21 | 000,233,472 | —- | C] () – C:\WINDOWS\System32\sndo763.dll
[2004/12/25 10:18:21 | 000,218,112 | —- | C] () – C:\WINDOWS\System32\drivers\sndo763.sys
[2004/12/25 10:18:21 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\dsndo763.dll
[2004/12/25 10:18:21 | 000,015,522 | —- | C] () – C:\WINDOWS\sndo763.ini
[2004/12/07 01:43:48 | 000,000,056 | RHS- | C] () – C:\WINDOWS\System32\18E2FC8E4C.sys
[2004/05/19 12:09:11 | 000,000,508 | —- | C] () – C:\WINDOWS\SIERRA.INI
[2004/05/09 07:23:37 | 000,000,226 | —- | C] () – C:\WINDOWS\wininit.ini
[2004/03/07 21:23:27 | 000,000,050 | —- | C] () – C:\WINDOWS\System32\MSrev01.dll
[2004/03/07 20:03:36 | 000,000,854 | —- | C] () – C:\WINDOWS\entpack.ini
[2004/02/03 23:56:49 | 000,000,026 | —- | C] () – C:\WINDOWS\System32\MSrev21.dll
[2004/02/03 23:56:45 | 000,000,093 | —- | C] () – C:\WINDOWS\System32\MSrev41.dll
[2004/01/03 17:01:13 | 000,000,633 | —- | C] () – C:\WINDOWS\fantasy2.ini
[2004/01/03 17:01:13 | 000,000,207 | —- | C] () – C:\WINDOWS\videoimp.ini
[2004/01/03 17:01:12 | 000,000,113 | —- | C] () – C:\WINDOWS\photoimpression.ini
[2004/01/03 17:00:54 | 000,010,240 | —- | C] () – C:\WINDOWS\System32\vidx16.dll
[2003/12/25 11:38:55 | 000,069,632 | —- | C] () – C:\WINDOWS\System32\Veo532ut.dll
[2003/12/25 11:38:55 | 000,036,864 | —- | C] () – C:\WINDOWS\System32\VeoSetup532.dll
[2003/12/19 15:00:48 | 000,000,801 | -HS- | C] () – C:\WINDOWS\System32\mmf.sys
[2003/12/19 15:00:48 | 000,000,801 | -HS- | C] () – C:\WINDOWS\System32\mmf(2)(2).sys
[2003/12/19 15:00:46 | 000,045,056 | —- | C] () – C:\WINDOWS\mmfs.dll
[2003/12/05 17:15:04 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2003/12/05 17:14:59 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\devenum(2).dll
[2003/11/23 20:10:30 | 000,000,402 | —- | C] () – C:\WINDOWS\Belt.ini
[2003/10/04 14:43:58 | 000,021,840 | —- | C] () – C:\WINDOWS\System32\SIntfNT.dll
[2003/10/04 14:43:58 | 000,017,212 | —- | C] () – C:\WINDOWS\System32\SIntf32.dll
[2003/10/04 14:43:58 | 000,012,067 | —- | C] () – C:\WINDOWS\System32\SIntf16.dll
[2003/08/23 09:59:24 | 000,046,512 | —- | C] () – C:\WINDOWS\System32\EPSN.DLL
[2003/08/23 09:59:24 | 000,011,934 | —- | C] () – C:\WINDOWS\System32\PIXPNR.DLL
[2003/08/23 09:59:23 | 000,012,126 | —- | C] () – C:\WINDOWS\System32\PIXPCZ.DLL
[2003/08/23 09:51:52 | 000,046,592 | —- | C] () – C:\WINDOWS\System32\WNASPI32.DLL
[2003/08/21 13:43:37 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2003/08/07 20:35:11 | 000,016,973 | —- | C] () – C:\WINDOWS\System32\ZWebAuth.dll
[2003/07/11 21:37:22 | 000,008,379 | —- | C] () – C:\WINDOWS\cdPlayer.ini
[2003/07/11 19:57:03 | 000,000,632 | —- | C] () – C:\WINDOWS\Qiii.INI
[2003/07/09 11:36:51 | 000,001,125 | —- | C] () – C:\WINDOWS\winamp.ini
[2003/07/08 22:30:05 | 000,098,816 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2003/07/08 21:49:41 | 000,000,344 | —- | C] () – C:\WINDOWS\QTW.INI
[2003/07/08 17:49:06 | 000,000,088 | —- | C] () – C:\WINDOWS\odbc.ini
[2003/07/07 10:07:55 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\iAlmcoin.dll
[2003/05/30 08:00:02 | 001,246,208 | —- | C] () – C:\WINDOWS\System32\quartz(2).dll
[2003/04/28 22:12:02 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2003/04/26 02:05:29 | 000,167,936 | —- | C] () – C:\WINDOWS\System32\PCDrJNI_1_1.dll
[2003/04/26 02:02:53 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\syscontr.dll
[2003/04/26 02:02:52 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\hpreg.dll
[2003/04/26 01:34:11 | 000,000,052 | —- | C] () – C:\WINDOWS\intuprof.ini
[2003/04/26 01:34:01 | 000,000,626 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2003/04/26 01:18:01 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2003/04/26 00:53:15 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM22.dll
[2003/04/26 00:53:15 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes22.dll
[2003/04/26 00:52:58 | 000,016,896 | —- | C] () – C:\WINDOWS\System32\bcbmm.dll
[2003/04/26 00:37:56 | 000,000,802 | —- | C] () – C:\WINDOWS\orun32.ini
[2003/04/26 00:24:49 | 000,000,552 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2003/04/25 17:28:36 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2003/03/01 02:47:30 | 000,158,790 | —- | C] () – C:\Documents and Settings\Owner\Local Settings\Application Data\SVGAbout001.svg
[2002/12/12 09:14:32 | 000,013,312 | —- | C] () – C:\WINDOWS\System32\msdmo(2).dll
[2002/10/03 13:42:27 | 000,000,034 | —- | C] () – C:\WINDOWS\Q3version.ini
[2002/08/20 19:37:50 | 000,093,696 | —- | C] () – C:\WINDOWS\System32\zlib.dll
[2002/04/11 13:47:52 | 000,049,152 | —- | C] () – C:\WINDOWS\System32\msmscoin.dll
[1999/12/02 18:45:46 | 000,046,864 | —- | C] () – C:\WINDOWS\System32\zoneauth.dll

< End of report >

mowman

Post #13January 12, 2011, 2:20 AM UTC

Yea I said i had super antispyware and adware

Neither of these are an antivirus,they are antispyware/antimalware apps.Please download Avira from the link below and run a full system scan.
http://www.avira.com/en/avira-free-antivirus

Timo529

Post #14January 14, 2011, 12:05 AM UTC

Ran the scan it found like 14 other objects. Here is the log from the scan Avira AntiVir Personal Report file date: Wednesday, January 12, 2011 23:37 Scanning for 2362511 virus strains and unwanted programs. The program is running as an unrestricted full version. Online services are available: Licensee : Avira AntiVir Personal - FREE Antivirus Serial number : 0000149996-ADJIE-0000001 Platform : Windows XP Windows version : (Service Pack 2) [5.1.2600] Boot mode : Normally booted Username : SYSTEM Computer name : YOUR-B79WZ4ROSE Version information: BUILD.DAT : 10.0.0.609 31824 Bytes 12/13/2010 09:43:00 AVSCAN.EXE : 10.0.3.5 435368 Bytes 12/13/2010 13:39:56 AVSCAN.DLL : 10.0.3.0 46440 Bytes 4/1/2010 17:57:04 LUKE.DLL : 10.0.3.2 104296 Bytes 12/13/2010 13:40:06 LUKERES.DLL : 10.0.0.1 12648 Bytes 2/11/2010 04:40:49 VBASE000.VDF : 7.10.0.0 19875328 Bytes 11/6/2009 14:05:36 VBASE001.VDF : 7.11.0.0 13342208 Bytes 12/14/2010 01:32:32 VBASE002.VDF : 7.11.0.1 2048 Bytes 12/14/2010 01:32:32 VBASE003.VDF : 7.11.0.2 2048 Bytes 12/14/2010 01:32:33 VBASE004.VDF : 7.11.0.3 2048 Bytes 12/14/2010 01:32:33 VBASE005.VDF : 7.11.0.4 2048 Bytes 12/14/2010 01:32:33 VBASE006.VDF : 7.11.0.5 2048 Bytes 12/14/2010 01:32:33 VBASE007.VDF : 7.11.0.6 2048 Bytes 12/14/2010 01:32:33 VBASE008.VDF : 7.11.0.7 2048 Bytes 12/14/2010 01:32:34 VBASE009.VDF : 7.11.0.8 2048 Bytes 12/14/2010 01:32:34 VBASE010.VDF : 7.11.0.9 2048 Bytes 12/14/2010 01:32:34 VBASE011.VDF : 7.11.0.10 2048 Bytes 12/14/2010 01:32:34 VBASE012.VDF : 7.11.0.11 2048 Bytes 12/14/2010 01:32:35 VBASE013.VDF : 7.11.0.52 128000 Bytes 12/16/2010 01:32:36 VBASE014.VDF : 7.11.0.91 226816 Bytes 12/20/2010 01:32:36 VBASE015.VDF : 7.11.0.122 136192 Bytes 12/21/2010 01:32:37 VBASE016.VDF : 7.11.0.156 122880 Bytes 12/24/2010 01:32:37 VBASE017.VDF : 7.11.0.185 146944 Bytes 12/27/2010 01:32:38 VBASE018.VDF : 7.11.0.228 132608 Bytes 12/30/2010 01:32:38 VBASE019.VDF : 7.11.1.5 148480 Bytes 1/3/2011 01:32:39 VBASE020.VDF : 7.11.1.37 156672 Bytes 1/7/2011 01:32:39 VBASE021.VDF : 7.11.1.65 140800 Bytes 1/10/2011 01:32:40 VBASE022.VDF : 7.11.1.87 225280 Bytes 1/11/2011 01:32:40 VBASE023.VDF : 7.11.1.88 2048 Bytes 1/11/2011 01:32:41 VBASE024.VDF : 7.11.1.89 2048 Bytes 1/11/2011 01:32:41 VBASE025.VDF : 7.11.1.90 2048 Bytes 1/11/2011 01:32:41 VBASE026.VDF : 7.11.1.91 2048 Bytes 1/11/2011 01:32:41 VBASE027.VDF : 7.11.1.92 2048 Bytes 1/11/2011 01:32:41 VBASE028.VDF : 7.11.1.93 2048 Bytes 1/11/2011 01:32:42 VBASE029.VDF : 7.11.1.94 2048 Bytes 1/11/2011 01:32:42 VBASE030.VDF : 7.11.1.95 2048 Bytes 1/11/2011 01:32:42 VBASE031.VDF : 7.11.1.110 60416 Bytes 1/12/2011 01:32:42 Engineversion : 8.2.4.140 AEVDF.DLL : 8.1.2.1 106868 Bytes 12/13/2010 13:39:51 AESCRIPT.DLL : 8.1.3.52 1282426 Bytes 1/13/2011 01:32:50 AESCN.DLL : 8.1.7.2 127349 Bytes 12/13/2010 13:39:50 AESBX.DLL : 8.1.3.2 254324 Bytes 12/13/2010 13:39:50 AERDL.DLL : 8.1.9.2 635252 Bytes 12/13/2010 13:39:50 AEPACK.DLL : 8.2.4.7 512375 Bytes 1/13/2011 01:32:49 AEOFFICE.DLL : 8.1.1.10 201084 Bytes 12/13/2010 13:39:49 AEHEUR.DLL : 8.1.2.64 3154294 Bytes 1/13/2011 01:32:48 AEHELP.DLL : 8.1.16.0 246136 Bytes 12/13/2010 13:39:42 AEGEN.DLL : 8.1.5.1 397683 Bytes 1/13/2011 01:32:44 AEEMU.DLL : 8.1.3.0 393589 Bytes 12/13/2010 13:39:42 AECORE.DLL : 8.1.19.0 196984 Bytes 12/13/2010 13:39:41 AEBB.DLL : 8.1.1.0 53618 Bytes 12/13/2010 13:39:41 AVWINLL.DLL : 10.0.0.0 19304 Bytes 12/13/2010 13:39:56 AVPREF.DLL : 10.0.0.0 44904 Bytes 12/13/2010 13:39:54 AVREP.DLL : 10.0.0.8 62209 Bytes 6/17/2010 19:27:13 AVREG.DLL : 10.0.3.2 53096 Bytes 12/13/2010 13:39:54 AVSCPLR.DLL : 10.0.3.2 84328 Bytes 12/13/2010 13:39:56 AVARKT.DLL : 10.0.22.6 231784 Bytes 12/13/2010 13:39:52 AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 12/13/2010 13:39:53 SQLITE3.DLL : 3.6.19.0 355688 Bytes 6/17/2010 19:27:22 AVSMTP.DLL : 10.0.0.17 63848 Bytes 12/13/2010 13:39:56 NETNT.DLL : 10.0.0.0 11624 Bytes 6/17/2010 19:27:21 RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 1/28/2010 18:10:20 RCTEXT.DLL : 10.0.58.0 97128 Bytes 12/13/2010 13:40:20 Configuration settings for the scan: Jobname………………………..: Complete system scan Configuration file………………: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp Logging………………………..: low Primary action………………….: interactive Secondary action………………..: ignore Scan master boot sector………….: on Scan boot sector………………..: on Boot sectors……………………: C:, D:, G:, Process scan……………………: on Extended process scan……………: on Scan registry…………………..: on Search for rootkits……………..: on Integrity checking of system files..: off Scan all files………………….: All files Scan archives…………………..: on Recursion depth…………………: 20 Smart extensions………………..: on Macro heuristic…………………: on File heuristic………………….: medium Start of the scan: Wednesday, January 12, 2011 23:37 Starting search for hidden objects. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\1 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\2 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\3 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\1 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\2 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\3 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\4 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\5 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\6 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\7 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\8 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\9 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\18 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\10 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\11 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\12 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\13 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\14 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\24 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\26 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\19 [NOTE] The registry entry is invisible. HKEY_LOCAL_MACHINE\Software\LicCtrl\LicCtrl\LicCtrl\LicCtrl\DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387\22 [NOTE] The registry entry is invisible. The scan of running processes will be started Scan process 'wscntfy.exe' - '23' Module(s) have been scanned Scan process 'avscan.exe' - '67' Module(s) have been scanned Scan process 'avcenter.exe' - '68' Module(s) have been scanned Scan process 'plugin-container.exe' - '65' Module(s) have been scanned Scan process 'firefox.exe' - '85' Module(s) have been scanned Scan process 'msdtc.exe' - '44' Module(s) have been scanned Scan process 'dllhost.exe' - '55' Module(s) have been scanned Scan process 'dllhost.exe' - '46' Module(s) have been scanned Scan process 'vssvc.exe' - '40' Module(s) have been scanned Scan process 'avgnt.exe' - '56' Module(s) have been scanned Scan process 'sched.exe' - '49' Module(s) have been scanned Scan process 'avshadow.exe' - '30' Module(s) have been scanned Scan process 'avguard.exe' - '59' Module(s) have been scanned Scan process 'MsMpEng.exe' - '42' Module(s) have been scanned Scan process 'SUPERANTISPYWARE.EXE' - '65' Module(s) have been scanned Scan process 'cfp.exe' - '70' Module(s) have been scanned Scan process 'Zmud.exe' - '45' Module(s) have been scanned Scan process 'Zmud.exe' - '15' Module(s) have been scanned Scan process 'fklogger.exe' - '37' Module(s) have been scanned Scan process 'ctfmon.exe' - '31' Module(s) have been scanned Scan process 'Explorer.EXE' - '96' Module(s) have been scanned Scan process 'alg.exe' - '37' Module(s) have been scanned Scan process 'nmsrvc.exe' - '80' Module(s) have been scanned Scan process 'TuneUpDefragService.exe' - '19' Module(s) have been scanned Scan process 'svchost.exe' - '42' Module(s) have been scanned Scan process 'runservice.exe' - '16' Module(s) have been scanned Scan process 'AppleMobileDeviceService.exe' - '38' Module(s) have been scanned Scan process 'svchost.exe' - '38' Module(s) have been scanned Scan process 'spoolsv.exe' - '61' Module(s) have been scanned Scan process 'svchost.exe' - '45' Module(s) have been scanned Scan process 'svchost.exe' - '36' Module(s) have been scanned Scan process 'svchost.exe' - '34' Module(s) have been scanned Scan process 'svchost.exe' - '169' Module(s) have been scanned Scan process 'cmdagent.exe' - '83' Module(s) have been scanned Scan process 'svchost.exe' - '43' Module(s) have been scanned Scan process 'svchost.exe' - '57' Module(s) have been scanned Scan process 'lsass.exe' - '55' Module(s) have been scanned Scan process 'services.exe' - '40' Module(s) have been scanned Scan process 'winlogon.exe' - '79' Module(s) have been scanned Scan process 'csrss.exe' - '17' Module(s) have been scanned Scan process 'smss.exe' - '2' Module(s) have been scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Boot sector 'G:\' [INFO] No virus was found! Starting to scan executable files (registry). C:\WINDOWS\system32\drivers\sptd.sys [WARNING] The file could not be opened! The registry was scanned ( '1742' files ). Starting the file scan: Begin scan in 'C:\' C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Quarantine\{000013FD-0000-0000-C9FD-58C1D5104441}\DATA.CAB [0] Archive type: CAB (Microsoft) [DETECTION] Contains recognition pattern of the ADSPY/eZula.CP.2 adware or spyware –> RESOURCE1 [1] Archive type: HIDDEN –> MEM\AV00001310.AV$ [DETECTION] Contains recognition pattern of the ADSPY/eZula.CP.2 adware or spyware C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Quarantine\{000025AC-0000-0000-5668-24B862F3ED92}\DATA.CAB [0] Archive type: CAB (Microsoft) [DETECTION] Contains recognition pattern of the DR/Perflogger.AH dropper –> RESOURCE1 [1] Archive type: HIDDEN –> MEM\AV00001312.AV$ –> AV00001312.AV$ [2] Archive type: RAR SFX (self extracting) –> bpk.exe [DETECTION] Contains recognition pattern of the DR/Perflogger.AH dropper –> bpkvw.exe [DETECTION] Contains recognition pattern of the DR/Perflogger.AH dropper –> bpkwb.dll [DETECTION] Is the TR/Perfect.4 Trojan –> downloads.url [DETECTION] Is the TR/Keylog.154 Trojan –> bpkr.exe [DETECTION] Is the TR/Spy.Perfect.3 Trojan [DETECTION] Contains recognition pattern of the ADSPY/AdSpy.Gen adware or spyware –> RESOURCE2 [1] Archive type: HIDDEN –> MEM\AV0000134d.AV$ [DETECTION] Contains recognition pattern of the DR/Perflogger.AD.53 dropper –> bpk.exe [DETECTION] Contains recognition pattern of the DR/Perflogger.AH dropper –> bpkun.exe –> Object [DETECTION] Is the TR/Spy.Agent.F.2 Trojan –> bpkvw.exe [DETECTION] Contains recognition pattern of the DR/Perflogger.AH dropper –> Setup.exe [DETECTION] Is the TR/Perfect.E Trojan –> bpki.dll [DETECTION] Is the TR/Peflog.30.4 Trojan –> downloads.url [DETECTION] Is the TR/Keylog.154 Trojan C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Quarantine\{000025AC-0000-0000-5A0F-80C513E57C71}\DATA.CAB [0] Archive type: CAB (Microsoft) [DETECTION] Contains recognition pattern of the DR/Perflogger.AD.53 dropper –> RESOURCE1 [1] Archive type: HIDDEN –> MEM\AV00001385.AV$ [DETECTION] Contains recognition pattern of the DR/Perflogger.AD.53 dropper –> bpk.exe [DETECTION] Contains recognition pattern of the DR/Perflogger.AH dropper –> bpkun.exe –> Object [DETECTION] Is the TR/Spy.Agent.F.2 Trojan –> bpkvw.exe [DETECTION] Contains recognition pattern of the DR/Perflogger.AH dropper –> Setup.exe [DETECTION] Is the TR/Perfect.E Trojan –> bpki.dll [DETECTION] Is the TR/Peflog.30.4 Trojan –> downloads.url [DETECTION] Is the TR/Keylog.154 Trojan –> RESOURCE2 [1] Archive type: HIDDEN –> MEM\AV000013bc.AV$ –> AV000013bc.AV$ [2] Archive type: RAR SFX (self extracting) –> bpk.exe [DETECTION] Contains recognition pattern of the DR/Perflogger.AH dropper –> bpkvw.exe [DETECTION] Contains recognition pattern of the DR/Perflogger.AH dropper –> bpkwb.dll [DETECTION] Is the TR/Perfect.4 Trojan –> downloads.url [DETECTION] Is the TR/Keylog.154 Trojan –> bpkr.exe [DETECTION] Is the TR/Spy.Perfect.3 Trojan [DETECTION] Contains recognition pattern of the ADSPY/AdSpy.Gen adware or spyware C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Quarantine\{000039B4-0001-0000-B5CC-10CFF0324F9F}\DATA.CAB [0] Archive type: CAB (Microsoft) [DETECTION] Contains recognition pattern of the ADSPY/WebSearch.X adware or spyware –> RESOURCE1 [1] Archive type: HIDDEN –> MEM\AV000013fc.AV$ [DETECTION] Contains recognition pattern of the ADSPY/WebSearch.X adware or spyware –> RESOURCE2 [1] Archive type: HIDDEN –> MEM\AV000013fd.AV$ [DETECTION] Contains recognition pattern of the ADSPY/WebSearch.X adware or spyware C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Quarantine\{00004022-0000-0000-36CB-B8AB14E5CA83}\DATA.CAB [0] Archive type: CAB (Microsoft) [DETECTION] Contains recognition pattern of the DR/Perflogger.AH dropper –> RESOURCE1 [1] Archive type: HIDDEN –> MEM\AV000013ff.AV$ –> AV000013ff.AV$ [2] Archive type: RAR SFX (self extracting) –> bpk.exe [DETECTION] Contains recognition pattern of the DR/Perflogger.AH dropper –> bpkvw.exe [DETECTION] Contains recognition pattern of the DR/Perflogger.AH dropper –> bpkwb.dll [DETECTION] Is the TR/Perfect.4 Trojan –> downloads.url [DETECTION] Is the TR/Keylog.154 Trojan –> bpkr.exe [DETECTION] Is the TR/Spy.Perfect.3 Trojan [DETECTION] Contains recognition pattern of the ADSPY/AdSpy.Gen adware or spyware C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Quarantine\{00004022-0000-0000-43E9-E72F96211433}\DATA.CAB [0] Archive type: CAB (Microsoft) [DETECTION] Contains recognition pattern of the DR/Perflogger.AH dropper –> RESOURCE1 [1] Archive type: HIDDEN –> MEM\AV0000143b.AV$ –> AV0000143b.AV$ [2] Archive type: RAR SFX (self extracting) –> bpk.exe [DETECTION] Contains recognition pattern of the DR/Perflogger.AH dropper –> bpkvw.exe [DETECTION] Contains recognition pattern of the DR/Perflogger.AH dropper –> bpkwb.dll [DETECTION] Is the TR/Perfect.4 Trojan –> downloads.url [DETECTION] Is the TR/Keylog.154 Trojan –> bpkr.exe [DETECTION] Is the TR/Spy.Perfect.3 Trojan [DETECTION] Contains recognition pattern of the ADSPY/AdSpy.Gen adware or spyware C:\Documents and Settings\Owner\.housecall6.6\Quarantine\mbhttpbf.exe.bac_a00868 [0] Archive type: HIDDEN [DETECTION] Contains recognition pattern of the DR/Pakes.A.7 dropper –> FIL\\\?\C:\Documents and Settings\Owner\.housecall6.6\Quarantine\mbhttpbf.exe.bac_a00868 [DETECTION] Contains recognition pattern of the DR/Pakes.A.7 dropper C:\Documents and Settings\Owner\.housecall6.6\Quarantine\PC Pitstop Optimize 1.5.x.x Patch.exe.bac_a00868 [0] Archive type: HIDDEN [DETECTION] Is the TR/Patch.F.2 Trojan –> FIL\\\?\C:\Documents and Settings\Owner\.housecall6.6\Quarantine\PC Pitstop Optimize 1.5.x.x Patch.exe.bac_a00868 [DETECTION] Is the TR/Patch.F.2 Trojan C:\Documents and Settings\Owner\.housecall6.6\Quarantine\sahagent1006.exe.bac_a00868 [0] Archive type: HIDDEN [DETECTION] Contains recognition pattern of the ADSPY/Sahat.B.2 adware or spyware –> FIL\\\?\C:\Documents and Settings\Owner\.housecall6.6\Quarantine\sahagent1006.exe.bac_a00868 [DETECTION] Contains recognition pattern of the ADSPY/Sahat.B.2 adware or spyware C:\Documents and Settings\Owner\.housecall6.6\Quarantine\setup_incred_7.exe.bac_a00868 [0] Archive type: HIDDEN [DETECTION] Is the TR/Dldr.Keenval.B.1 Trojan –> FIL\\\?\C:\Documents and Settings\Owner\.housecall6.6\Quarantine\setup_incred_7.exe.bac_a00868 [DETECTION] Is the TR/Dldr.Keenval.B.1 Trojan C:\Documents and Settings\Owner\Desktop\Tim\CometBird.en-US.installer.exe –> Object [WARNING] The file could not be read! [WARNING] The file could not be read! C:\Documents and Settings\Owner\Desktop\Tim\tyrian\UHS_Reader_v5.10a_Keygen_by_MP2K.zip [0] Archive type: ZIP [DETECTION] Contains a recognition pattern of the (harmful) BDS/Bot.7930 back-door program –> uhs.reader.5.10a-keygen.exe [DETECTION] Contains a recognition pattern of the (harmful) BDS/Bot.7930 back-door program –> run.exe [DETECTION] Is the TR/Dropper.Gen Trojan –> ProgramFilesDir/crsowkxowl.exe [DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan –> ProgramFilesDir/imex.bat [DETECTION] Is the TR/Dldr.Zlob.ABJP.3 Trojan C:\Documents and Settings\Owner\Desktop\Tim\zsnes\245379.zip [0] Archive type: ZIP [DETECTION] Is the TR/Agent.436360 Trojan –> dll/declib.exe [DETECTION] Is the TR/Agent.436360 Trojan –> MsgUpdate.dll [DETECTION] Contains recognition pattern of the ADSPY/Agent.ona adware or spyware –> IgfxSys.dll [DETECTION] Contains recognition pattern of the ADSPY/Agent.omz adware or spyware –> phuninst.dll [DETECTION] Contains recognition pattern of the ADSPY/Agent.onb adware or spyware C:\Program Files\Common Files\Updates\msnvr.dll [DETECTION] Is the TR/PSW.Bronc.B Trojan C:\Program Files\Common Files\Updates\updater.dll [DETECTION] Is the TR/PSW.Bronc.A.7 Trojan C:\Program Files\Starcraft\StarCraftv1.14SinglePlayerMultiplayerNoCDFixedexeEng.rar [0] Archive type: RAR [DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan –> StarCraft_Loader.exe [DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan C:\Program Files\Starcraft\StarCraft_Loader.exe [DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan C:\System Volume Information\_restore{84385F41-106C-4862-86C4-CE41F08F6FCF}\RP2803\A0362140.exe [DETECTION] Is the TR/Spy.142336.1 Trojan C:\WINDOWS\system32\mmf.sys [WARNING] The file could not be opened! C:\WINDOWS\system32\drivers\sptd.sys [WARNING] The file could not be opened! C:\WINDOWS\wt\webdriver\wtmulti.dll [DETECTION] Contains recognition pattern of the ADSPY/WildTangent.A adware or spyware C:\zMUD\Zmud721Crack.exe [DETECTION] Is the TR/WGAPatch.CF Trojan Begin scan in 'D:\' Begin scan in 'G:\' G:\BPK\downloads.url [DETECTION] Is the TR/Keylog.154 Trojan G:\BPK\bpki.dll [DETECTION] Is the TR/Peflog.30.4 Trojan Beginning disinfection: G:\BPK\bpki.dll [DETECTION] Is the TR/Peflog.30.4 Trojan [NOTE] The file was moved to the quarantine directory under the name '471d544c.qua'. G:\BPK\downloads.url [DETECTION] Is the TR/Keylog.154 Trojan [NOTE] The file was moved to the quarantine directory under the name '5fb67bea.qua'. C:\zMUD\Zmud721Crack.exe [DETECTION] Is the TR/WGAPatch.CF Trojan [NOTE] The file was deleted! C:\WINDOWS\wt\webdriver\wtmulti.dll [DETECTION] Contains recognition pattern of the ADSPY/WildTangent.A adware or spyware [NOTE] The file was moved to the quarantine directory under the name '0dd72107.qua'. C:\System Volume Information\_restore{84385F41-106C-4862-86C4-CE41F08F6FCF}\RP2803\A0362140.exe [DETECTION] Is the TR/Spy.142336.1 Trojan [NOTE] The file was moved to the quarantine directory under the name '6b1a6e81.qua'. C:\Program Files\Starcraft\StarCraft_Loader.exe [DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan [NOTE] The file was deleted! C:\Program Files\Starcraft\StarCraftv1.14SinglePlayerMultiplayerNoCDFixedexeEng.rar [DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan [NOTE] The file was deleted! C:\Program Files\Common Files\Updates\updater.dll [DETECTION] Is the TR/PSW.Bronc.A.7 Trojan [NOTE] The file was moved to the quarantine directory under the name '2e6d43f8.qua'. C:\Program Files\Common Files\Updates\msnvr.dll [DETECTION] Is the TR/PSW.Bronc.B Trojan [NOTE] The file was moved to the quarantine directory under the name '5178719a.qua'. C:\Documents and Settings\Owner\Desktop\Tim\zsnes\245379.zip [DETECTION] Contains recognition pattern of the ADSPY/Agent.onb adware or spyware [NOTE] The file was moved to the quarantine directory under the name '1d3f5dae.qua'. C:\Documents and Settings\Owner\Desktop\Tim\tyrian\UHS_Reader_v5.10a_Keygen_by_MP2K.zip [DETECTION] Is the TR/Dldr.Zlob.ABJP.3 Trojan [NOTE] The file was moved to the quarantine directory under the name '61c51dea.qua'. C:\Documents and Settings\Owner\.housecall6.6\Quarantine\setup_incred_7.exe.bac_a00868 [DETECTION] Is the TR/Dldr.Keenval.B.1 Trojan [NOTE] The file was moved to the quarantine directory under the name '4cbc32c0.qua'. C:\Documents and Settings\Owner\.housecall6.6\Quarantine\sahagent1006.exe.bac_a00868 [DETECTION] Contains recognition pattern of the ADSPY/Sahat.B.2 adware or spyware [NOTE] The file was moved to the quarantine directory under the name '55e00946.qua'. C:\Documents and Settings\Owner\.housecall6.6\Quarantine\PC Pitstop Optimize 1.5.x.x Patch.exe.bac_a00868 [DETECTION] Is the TR/Patch.F.2 Trojan [NOTE] The file was moved to the quarantine directory under the name '39642508.qua'. C:\Documents and Settings\Owner\.housecall6.6\Quarantine\mbhttpbf.exe.bac_a00868 [DETECTION] Contains recognition pattern of the DR/Pakes.A.7 dropper [NOTE] The file was moved to the quarantine directory under the name '48051ce2.qua'. C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Quarantine\{00004022-0000-0000-43E9-E72F96211433}\DATA.CAB [DETECTION] Contains recognition pattern of the ADSPY/AdSpy.Gen adware or spyware [NOTE] The file was moved to the quarantine directory under the name '460b2c44.qua'. C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Quarantine\{00004022-0000-0000-36CB-B8AB14E5CA83}\DATA.CAB [DETECTION] Contains recognition pattern of the ADSPY/AdSpy.Gen adware or spyware [NOTE] The file was moved to the quarantine directory under the name '03225506.qua'. C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Quarantine\{000039B4-0001-0000-B5CC-10CFF0324F9F}\DATA.CAB [DETECTION] Contains recognition pattern of the ADSPY/WebSearch.X adware or spyware [NOTE] The file was moved to the quarantine directory under the name '0a2951ac.qua'. C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Quarantine\{000025AC-0000-0000-5A0F-80C513E57C71}\DATA.CAB [DETECTION] Contains recognition pattern of the ADSPY/AdSpy.Gen adware or spyware [NOTE] The file was moved to the quarantine directory under the name '526848c5.qua'. C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Quarantine\{000025AC-0000-0000-5668-24B862F3ED92}\DATA.CAB [DETECTION] Is the TR/Keylog.154 Trojan [NOTE] The file was moved to the quarantine directory under the name '7e9c3109.qua'. C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Quarantine\{000013FD-0000-0000-C9FD-58C1D5104441}\DATA.CAB [DETECTION] Contains recognition pattern of the ADSPY/eZula.CP.2 adware or spyware [NOTE] The file was moved to the quarantine directory under the name '406251d3.qua'. End of the scan: Thursday, January 13, 2011 07:30 Used time: 5:58:13 Hour(s) The scan has been done completely. 11488 Scanned directories 516583 Files were scanned 62 Viruses and/or unwanted programs were found 0 Files were classified as suspicious 3 files were deleted 0 Viruses and unwanted programs were repaired 18 Files were moved to quarantine 0 Files were renamed 3 Files cannot be scanned 516518 Files not concerned 20062 Archives were scanned 5 Warnings 21 Notes 352181 Objects were scanned with rootkit scan 22 Hidden objects were found The redirect problem seems to be fixed now though:) Any other suggestions for things to do? I really appreciate the help by the way

mowman

Post #15January 14, 2011, 1:09 AM UTC

Please run OTL and post the log.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Google Redirect

✨ Ask AI

Ask AI